Re: [DNSOP] CDS RRtype - automated KSK rollover

2011-07-12 Thread Edward Lewis
At 19:03 +0100 7/8/11, Stephen Morris wrote: Don't get me wrong, I don't want any unnecessary delay. But if it turns out that what is being addressed is part of a larger problem, it's worth looking first to see if there is a general solution. I sent a response to the chairs and to George earl

Re: [DNSOP] CDS RRtype - automated KSK rollover

2011-07-08 Thread Joe Abley
On 2011-07-08, at 18:23, Olafur Gudmundsson wrote: > Just let Whois die a peaceful death, it serves no purpose other than make > work. Other people are working on the death of whois; I was just trying to clarify the type of data I was talking about. Joe _

Re: [DNSOP] CDS RRtype - automated KSK rollover

2011-07-08 Thread Olafur Gudmundsson
On 08/07/2011 5:18 PM, Joe Abley wrote: On 2011-07-08, at 14:03, Stephen Morris wrote: If the answer is yes, then the CDS approach is certainly one to be looked at. The answer also suggests that we should be looking at an equivalent mechanism for updating NS (and possibly glue) information in

Re: [DNSOP] CDS RRtype - automated KSK rollover

2011-07-08 Thread Joe Abley
On 2011-07-08, at 14:03, Stephen Morris wrote: > If the answer is yes, then the CDS approach is certainly one to be > looked at. The answer also suggests that we should be looking at an > equivalent mechanism for updating NS (and possibly glue) information in > the parent zone. Perhaps all can

Re: [DNSOP] CDS RRtype - automated KSK rollover

2011-07-08 Thread Stephen Morris
On 30/06/2011 23:33, George Barwood wrote: > Is the earlier requirements draft from 2005 (linked above) substantially > incomplete in some way? > I think that would be a reasonable basis to measure, I would claim that the > CDS > record is capable of satisfying the requirements expressed there i

Re: [DNSOP] CDS RRtype - automated KSK rollover

2011-07-06 Thread Chris Thompson
On Jul 5 2011, George Barwood wrote: The intent is to restrict the ability to update the parent DS to those who have access to key signing keys. Thus where there is a split responsibility (similar to the root zone where IANA has the KSK private key, and Verisign has only the ZSK private key ), o

Re: [DNSOP] CDS RRtype - automated KSK rollover

2011-07-05 Thread Olafur Gudmundsson
On 05/07/2011 3:48 PM, Chris Thompson wrote: On Jun 30 2011, Olafur Gudmundsson wrote: [... snip ...] It would be nice, and make the system more robust. FWIW I think NS can be automatically maintained after we have DNSSEC by having the parent copy what the child publishes. At first sight this

Re: [DNSOP] CDS RRtype - automated KSK rollover

2011-07-05 Thread George Barwood
- Original Message - From: "Chris Thompson" To: "George Barwood" Cc: Sent: Tuesday, July 05, 2011 9:09 PM Subject: Re: [DNSOP] CDS RRtype - automated KSK rollover > On Jun 12 2011, George Barwood wrote: > >>I have updated the draft >> >>h

Re: [DNSOP] CDS RRtype - automated KSK rollover

2011-07-05 Thread Chris Thompson
On Jun 12 2011, George Barwood wrote: I have updated the draft http://www.ietf.org/id/draft-barwood-dnsop-ds-publish-02.txt I have added an appendix with an exampler KSK rollover, and made various generally minor changes. IANA have now assigned type code 59 for the CDS RRtype. I'd like to re

Re: [DNSOP] CDS RRtype - automated KSK rollover

2011-07-05 Thread Chris Thompson
On Jun 30 2011, Olafur Gudmundsson wrote: [... snip ...] It would be nice, and make the system more robust. FWIW I think NS can be automatically maintained after we have DNSSEC by having the parent copy what the child publishes. At first sight this looks as though it only involves the parent a

Re: [DNSOP] CDS RRtype - automated KSK rollover

2011-06-30 Thread George Barwood
- Original Message - From: "Stephen Morris" To: Sent: Thursday, June 30, 2011 3:32 PM Subject: Re: [DNSOP] CDS RRtype - automated KSK rollover > On 12/06/2011 20:50, George Barwood wrote: >> I have updated the draft >> >> http://www.ietf.org/id/draft-

Re: [DNSOP] CDS RRtype - automated KSK rollover

2011-06-30 Thread Stephen Morris
On 30/06/2011 17:30, Olafur Gudmundsson wrote: >> So it seems to me that the first step would be to write a draft that >> defines the problem and the requirements for a solution. (The >> requirements should include real-world requirements, e.g. how do we >> assess the potential bypassing of a regis

Re: [DNSOP] CDS RRtype - automated KSK rollover

2011-06-30 Thread Olafur Gudmundsson
On 30/06/2011 10:32 AM, Stephen Morris wrote: On 12/06/2011 20:50, George Barwood wrote: I have updated the draft http://www.ietf.org/id/draft-barwood-dnsop-ds-publish-02.txt . I agree with Ed and think that we before adopting a solution, we should step back and ask some basic questions s

Re: [DNSOP] CDS RRtype - automated KSK rollover

2011-06-30 Thread Antoin Verschuren
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 30-06-11 16:32, Stephen Morris wrote: > > * Does this raise any issues with regards to transferring secure domains > between registrars? There isn't any issue transfering secure domains between registrars. There might only be an issue transfering

Re: [DNSOP] CDS RRtype - automated KSK rollover

2011-06-30 Thread Stephen Morris
On 12/06/2011 20:50, George Barwood wrote: > I have updated the draft > > http://www.ietf.org/id/draft-barwood-dnsop-ds-publish-02.txt > > I have added an appendix with an exampler KSK rollover, and made > various generally minor changes. > > IANA have now assigned type code 59 for the CDS RRtyp

[DNSOP] CDS RRtype - automated KSK rollover

2011-06-12 Thread George Barwood
I have updated the draft http://www.ietf.org/id/draft-barwood-dnsop-ds-publish-02.txt I have added an appendix with an exampler KSK rollover, and made various generally minor changes. IANA have now assigned type code 59 for the CDS RRtype. I'd like to request that the WG adopt this document. G