<html><body bgcolor="#FFFFFF"><div>And then you also have section "<span class="Apple-style-span" style="font-size: 16px; -webkit-tap-highlight-color: rgba(26, 26, 26, 0.289062); -webkit-composition-fill-color: rgba(175, 192, 227, 0.222656); -webkit-composition-frame-color: rgba(77, 128, 180, 0.222656); font-family: -webkit-monospace; font-weight: bold; line-height: 0px; white-space: pre; "><a name="section-6.6">6.6</a>. Trust Point Deletion" </span>which requires operator interaction before the key is added to the zone.</div><div><br></div><div>So for now I think we need to put a comment in the rng that says that it is not implented yet.</div><div><br>15 okt 2009 kl. 20.03 skrev "<a href="mailto:Stephen.Morris@nominet.org.uk">Stephen.Morris@nominet.org.uk</a>" <<a href="mailto:Stephen.Morris@nominet.org.uk">Stephen.Morris@nominet.org.uk</a>>:<br><br></div><div></div><blockquote type="cite"><div><tt><font size="2">Rickard Bondesson <<a href="mailto:rickard.bondesson@iis.se">rickard.bondesson@iis.se</a>> wrote
on 15/10/2009 15:45:10:<br>
<br>
> Hi</font></tt>
<br><tt><font size="2">> </font></tt>
<br><tt><font size="2">> When going through the functionality of OpenDNSSEC,
I see that we have not <br>
> implemented RFC5011. And I think that it is nothing that you can code
during a<br>
> couple of hours and then be finished.</font></tt>
<br><tt><font size="2">> </font></tt>
<br><tt><font size="2">> Any comments?</font></tt>
<br>
<br><tt><font size="2">You are right. Although you can mess around
with the key timing and safety margins to get the appropriate hold-down
time before and after the key is used, I would think it needs a bit of
work in both KASP and the signer to handle the revoke bit. Ideally,
we would want a <rfc5011/> option that would automatically modify
any policy to operate within the constraints set by the RFC.</font></tt>
<br>
<br><tt><font size="2">I suggest we put it on the feature list for 1.1. It's
too late to include it now.</font></tt>
<br>
<br><tt><font size="2">Stephen</font></tt>
<br>
<br><tt><font size="2">BTW, I've just updated the key timing draft and included
an interpretation of how RFC 5011 affects the key roll process - see </font></tt><a href="http://tools.ietf.org/html/draft-morris-dnsop-dnssec-key-timing-01"><tt><font size="2">http://tools.ietf.org/html/draft-morris-dnsop-dnssec-key-timing-01</font></tt></a><tt><font size="2">.
</font></tt></div></blockquote></body></html>