<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Arial" size="2">
<div>-----BEGIN PGP SIGNED MESSAGE-----</div>
<div>Hash: SHA256</div>
<div> </div>
<div>> The problem with a fully-automated system here is that although</div>
<div>> OpenDNSSEC can start publishing the new KSK in the zone, it has no way</div>
<div>> of knowing whether the DS record has been submitted to the parent (or</div>
<div>> even that the KSK rollover has been noticed by the operator).</div>
<div>> </div>
<div>> I would suggest that the following requires a minimum amount of work to</div>
<div>> the enforcer:</div>
<div>> </div>
<div>> a) New KSK is introduced into the zone automatically and messages</div>
<div>> appears in the logs. (This already happens.)</div>
<div>> b) At some time, the new key moves into the "active" state and the old</div>
<div>> key into a "retire" state. In these states, both keys continue to be</div>
<div>> published. However, the enforcer is altered so as to set the amount of</div>
<div>> time the KSK stays in the "retire" state to some very large value.</div>
<div>> c) The operator is required to acknowledge that the DS record has</div>
<div>> appeared in the parent. This new command resets the retire time of the</div>
<div>> KSK to:</div>
<div>> </div>
<div>> max(TTL of record in parent zone + estimate of propagation delay</div>
<div>> through parent zone,</div>
<div>> TTL of record in this zone + estimate of propagation delay</div>
<div>> through this zone) +</div>
<div>> safety margin</div>
<div>> </div>
<div>> d) The old KSK is not removed until the retire time has expired. (In</div>
<div>> other words, we protect the user by keeping the old KSK in the zone for</div>
<div>> long enough to guarantee that the old DS and DNSKEY RRsets have expired</div>
<div>> from all validators.)</div>
<div>> </div>
<div>> (Note that step (c) may occur before step (b), in which case step (b)</div>
<div>> should not reset the retire time.)</div>
<div> </div>
<div>+1</div>
<div> </div>
<div>So we are missing step c (and the large value part of b) in OpenDNSSEC. Which I think we need before v1.0.</div>
<div> </div>
<div>Should I create a Pivotal story about this?</div>
<div> </div>
<div>// Rickard</div>
<div> </div>
<div>-----BEGIN PGP SIGNATURE-----</div>
<div>Version: 9.8.3 (Build 4028)</div>
<div>Charset: utf-8</div>
<div> </div>
<div>wsBVAwUBSvAwBuCjgaNTdVjaAQjRSgf+MOoK0cbLUJYjvoN90DVMLkKeRWnsCsCn</div>
<div>g+hY1Yn1Rr5A2nkM6C3YYo0mCaX54IIie6SBxjpponLBph56T/Q1d/2tmYNcuqZR</div>
<div>Tltmk2+GU9z/+g9rCMf8iJnJeccOwjNb9LY3za9pNXuleOy5lAbRkJGIRGPR9Uog</div>
<div>d2yOLhhrdZWhgUXFP/9rcJ9Z0p2mTI7X5msCI7DBURx2V3dc6Z9kKVnXcAtpczCF</div>
<div>/yKnO2hS53H9hlD7iTldKkKSrdv8qPYGeRFNblWsoPRpNfnzCEiglI5Tw4eVn1t4</div>
<div>afe22W1rgtDmDJp/GNyvA0YVpPjOBh3fHKx7izcVMRT5Ys0xbWdnkA==</div>
<div>=iJZ7</div>
<div>-----END PGP SIGNATURE-----</div>
<div> </div>
<div> </div>
</font>
</body>
</html>