[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [dnsext] RRTYPE request: template for proposed RKEY RRtype
On Dec 4 2008, Ondřej Surý wrote:
It's just a key. Rollover is irrelevant. When a new key is needed, the
old one is retired and the data gets encrypted with the new one. If this
isn't done, the decryption fails. Which is the sole responsibility of
whoever publishes that key and the encrypted NAPTRs associated with that
key.
Unless you are proposing that RKEY records always have a TTL of zero,
Or owner can publish two RKEYs and start encrypting with second key
after all caches are clear. (similar to pre-publish method of rotating
DNSKEYs). Or am I missing something?
No, this is probably quite adequate, together with a rubric that clients
need to try all RKEYs in the RRset, possibly weakly distinguished by
footprint, etc.
It's just that there is nothing about this in draft-reid-dnsext-rkey-00,
and I think there ought to be. But on further consideration, I agree
that there doesn't need to be anything about it in the template itself.
--
Chris Thompson
Email: cet1@cam.ac.uk
--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>