Re: rfc4310bis 03 AD Feedback
Andrew Sullivan <[email protected]>
| Newsgroups | gmane.ietf.provreg |
|---|---|
| Message-ID | <[email protected]> |
On Thu, Jan 28, 2010 at 04:00:52PM +0000, [email protected] wrote: > What's the rationale for giving the child _any_ say in the DS record > signature lifetimes as presented in the parent zone? The idea is that the child might want to have some maximum above which it doesn't go, so that the child can roll keys in a predictable way. This unfortunately ignores the effects of the RR TTL on the whole issue, and IMO is a foot-gun loaded for bear, because it makes it trivially easy to set the RRSIG short enough that an RRSIG expires while in cache. Without a knob to control TTLs, I don't know why you'd allow this to be adjusted. A -- Andrew Sullivan [email protected] Shinkuro, Inc. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- List run by majordomo software. For (Un-)subscription and similar details send "help" to [email protected]