Re: Revision of 4310

Andrew Sullivan <[email protected]>
Newsgroups gmane.ietf.provreg
Message-ID <[email protected]>
On Tue, Jan 26, 2010 at 09:44:40AM -0500, James Gould wrote:
> Andrew,
> 
> I don¹t understand why the client wouldn¹t just add the DS when it becomes
> active to the server instead of pre-publishing and activating.  Adding an

Because of caches, and the TTL on the parent zone which is not
controllable by the client.

If you have to do an emergency key rollover, you _can't_ stop using
your old key until the longest TTL in the system without your zone
validating bogus.  If the parent at the start only has the old DS, and
you've yanked the corresponding DNSKEY because you know it to be
compromised, then anyone who hits a cache containing the old DS will
get it until it has expired.

If the parent-held DS RRSet contains a DS corresponding to a new
DNSKEY, then you can cycle that DNSKEY in immediately.  You might not
have been using it, or even publishing it in the DNSKEY RRSet because
you might have wanted to keep your response size reasonably small.

The EPP extension as it stands just doesn't support this option. 

A

-- 
Andrew Sullivan
[email protected]
Shinkuro, Inc.
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
List run by majordomo software.  For (Un-)subscription and similar details
send "help" to [email protected]
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.