Re: rfc4310bis 03 AD Feedback

Andrew Sullivan <[email protected]>
Newsgroups gmane.ietf.provreg
Message-ID <[email protected]>
On Thu, Jan 28, 2010 at 04:00:52PM +0000, [email protected] wrote:
> What's the rationale for giving the child _any_ say in the DS record 
> signature lifetimes as presented in the parent zone?

The idea is that the child might want to have some maximum above which
it doesn't go, so that the child can roll keys in a predictable way.
This unfortunately ignores the effects of the RR TTL on the whole
issue, and IMO is a foot-gun loaded for bear, because it makes it
trivially easy to set the RRSIG short enough that an RRSIG expires
while in cache.  Without a knob to control TTLs, I don't know why
you'd allow this to be adjusted.

A

-- 
Andrew Sullivan
[email protected]
Shinkuro, Inc.
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
List run by majordomo software.  For (Un-)subscription and similar details
send "help" to [email protected]
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.