The IESG has approved the following document: - 'Automated Updates of DNSSEC Trust Anchors ' <draft-ietf-dnsext-trustupdate-timers-06.txt> as a Proposed Standard This document is the product of the DNS Extensions Working Group. The IESG contact persons are Mark Townsley and Jari Arkko. A URL of this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-dnsext-trustupdate-timers-06.txt Technical Summary The document describes a means for automatically updating public keys that are configured in DNSSEC aware resolvers. New trust-anchors are configured when signatures over them can be validated using the previous trust-anchors. By introducing explicit revocation and a delay mechanism the chances of an attacker introducing a mala fide trust-anchor after a key compromise are mitigated, albeit not solved. Working Group Summary There is a broad consensus that this solution provides a workable key-rollover. The working group is aware of IPR issues. There have been a number of well-documented reviews and comment on this document, please see the PROTO statement for a detailed overview. Protocol Quality There are no implementations yet. The chairs are aware of at least 1 and maybe 2 independent organizations that plan on implementing. At least one implementer has done in-depth review during last call. The chairs are of the opinion that after implementations are written there is probably millage in documenting operational experiences. Note to RFC Editor Please append the following to the Security Considerations section: "Security considerations for trust anchor rollover not specific to this protocol are discussed in [ID.ietf-dnsext-rollover-requirements]" and add this to the informative references: [ID.ietf-dnsext-rollover-requirements] Eland, H., Mundy R., Crocker, S., and S. Krishnaswamy, "Requirements related to DNSSEC Trust Anchor Rollover", draft-ietf-dnsext-rollover-requirements-04 (work in progress), November 2006. _______________________________________________ IETF-Announce@ietf.org https://www1.ietf.org/mailman/listinfo/ietf-announce
