<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 10/10/2014 3:08 PM, Richard Lamb
wrote:<br>
</div>
<blockquote
cite="mid:b17d4278befe40ffa6b5a1059176164c@PMBX112-W1-CA-1.PEXCH112.ICANN.ORG"
type="cite">
<pre wrap="">Jakob's right. If I understand question correctly, you always need two KSK
RRSIGs to be able to simultaneously validate with either TA. I learned that
when I was testing ksrsigner.c for key rolls. -Rick</pre>
</blockquote>
<br>
That's not what the stuff below was about exactly. <br>
<br>
The issue is actually that the trust chains from A and B can't ever
be independent because both chains must pass through the monolithic
signed root DNSKEY RRSet. So its impossible to set up a zone that
can *only* be verified if you've installed "B" as a trust anchor.
(*sigh* That's not exactly the right way to say it but close enough
for government work....)<br>
<br>
Mike<br>
<br>
<br>
<br>
<br>
<blockquote
cite="mid:b17d4278befe40ffa6b5a1059176164c@PMBX112-W1-CA-1.PEXCH112.ICANN.ORG"
type="cite">
<pre wrap="">
-----Original Message-----
From: <a class="moz-txt-link-abbreviated" href="mailto:ksk-rollover-bounces@icann.org">ksk-rollover-bounces@icann.org</a> [<a class="moz-txt-link-freetext" href="mailto:ksk-rollover-bounces@icann.org">mailto:ksk-rollover-bounces@icann.org</a>]
On Behalf Of Jakob Schlyter
Sent: Thursday, October 09, 2014 11:06 PM
To: Paul Hoffman
Cc: <a class="moz-txt-link-abbreviated" href="mailto:ksk-rollover@icann.org">ksk-rollover@icann.org</a>
Subject: Re: [ksk-change] Testing new keys added
On 10 okt 2014, at 04:19, Paul Hoffman <a class="moz-txt-link-rfc2396E" href="mailto:paul.hoffman@vpnc.org"><paul.hoffman@vpnc.org></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Assuming that a rollover uses the Double-KSK method described previously,
</pre>
</blockquote>
<pre wrap="">is there an intention to test systems for the new SEP key before removing
the old one? That is, if A is the current KSK and IANA adds B, after the
30-day hold-down time, either key could be used to sign zones in the root.
No, both keys needs to sign the ZSK that signs the DS records in the root
zone. And that invalidates the rest of your (otherwise interesting)
proposal. Sorry :-/
jakob
_______________________________________________
ksk-rollover mailing list
<a class="moz-txt-link-abbreviated" href="mailto:ksk-rollover@icann.org">ksk-rollover@icann.org</a>
<a class="moz-txt-link-freetext" href="https://mm.icann.org/mailman/listinfo/ksk-rollover">https://mm.icann.org/mailman/listinfo/ksk-rollover</a>
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
ksk-rollover mailing list
<a class="moz-txt-link-abbreviated" href="mailto:ksk-rollover@icann.org">ksk-rollover@icann.org</a>
<a class="moz-txt-link-freetext" href="https://mm.icann.org/mailman/listinfo/ksk-rollover">https://mm.icann.org/mailman/listinfo/ksk-rollover</a>
</pre>
</blockquote>
<br>
</body>
</html>