[ksk-change] Capabilities of validating systems we need to consider

Paul Hoffman paul.hoffman at vpnc.org
Sun Sep 21 15:27:26 UTC 2014

Greetings again. In thinking about the question of "what would happen if we changed the KSK", but without thinking about why and when, it would be good to think about what kinds of systems are out there. My initial list came to three categories of capabilities:

1) Able to automatically pull and correctly use a new KSK

2) Cannot automatically pull a new KSK, or cannot correctly use an automatically-pulled KSK; however, it can correctly get and use a new KSK with operator intervention

3) Even with operator intervention, cannot pull a new KSK or cannot correctly use an manually-pulled KSK

Are there other categories that would look operationally different to either customers of the system or to operators of signed zones?

We will certainly later debate how many systems are in these categories and if those systems are "important", but it would be good to start with the smallest complete set to talk about.

--Paul Hoffman

More information about the ksk-rollover mailing list