Subject: [saag] RFC 5011 to IS question

From: Stephen Farrell <[email-masked]>
Date: Wed, 28 Nov 2012 17:30:46 +0000

Hi,

The IESG recently are considering a request to move
RFC 5011 [1] to Internet Standard. This is a fine RFC
but I have one question and I'd be interested if
anyone here has input.

Should we re-think any of the timer values here in
the light of the fact that it took a few weeks to
find out about diginotar?

In particular the 30 day add hold-down timer might
arguably be better off at ~90 days if additions are
planned well ahead of time and there are no bad side
effects of a longer timer and we assume that gossipy
protocols might detect bad new trust points in a few
weeks, but not necessarily sooner. (Say if detection
needed a clueful traveller to go to place X, see the
bad new trust point and return to somewhere where the
bad new trust point isn't seen.)

I think the answer is "its still ok" and plan to
remove my discuss on this shortly, but wanted to
check in case others who know more about DNSSEC
think differently. (Note - nobody brought this up
during IETF LC, its just me asking.)

Thanks,
S.

[1] http://tools.ietf.org/html/rfc5011

---

From: Wes Hardaker <[email-masked]>
Date: Fri, 30 Nov 2012 11:01:50 -0800

Stephen Farrell <[email-masked]> writes:

> planned well ahead of time

The end of your sentence captures the problem well...

I agree, I'd love the case where we could always publish far enough in
advance not to worry about a huge hold-down time.  But the reality is,
the real world is not so nice and I suspect there are times that people
would be annoyed by the 30 day hold-down (eg, when believe but don't
know that the current key may have been "seen").  So the 30 days seems
like a reasonable compromise to me, and I'm not sure I'd want to move it
either direction.  If I move it in the direction you're talking about,
it probably would be to something like 45 or 60.  But the reality is
that if you an operator can't see a problem in 30 days, I'm not sure
anything longer will help them.
-- 
Wes Hardaker                                     
My Pictures:  http://capturedonearth.com/
My Thoughts:  http://pontifications.hardakers.net/