<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Feb 21, 2018, at 11:50 AM, Michael StJohns <<a href="mailto:msj@nthpermutation.com" class="">msj@nthpermutation.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div text="#000000" bgcolor="#FFFFFF" class=""><blockquote type="cite" cite="mid:77116395-DAFB-42CA-A2D5-7C12AA6A5B92@icann.org" style="font-family: HelveticaNeue; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><blockquote type="cite" style="" class=""><pre wrap="" class="">So if you're really going down this path, you've probably got a lot more work than just checking against older KSKs.
</pre></blockquote><pre wrap="" class="">I fully disagree with this, and with Ed's assertions. Checking for a matching key tag in the current and previous KSK set is sufficient to reduce ambiguity for manual use of key tags, which is what Warren's suggestion was about.</pre></blockquote><span style="font-family: HelveticaNeue; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;" class="">So what you're saying is that you're going to conditionally repeat an operation that has a ritual associated with it (and indeed modify the ritual so this happens) until you get non-matching key tags for the sole purpose of someone later on looking at the key and saying "not a match". A complex ritual with specific requirements and a large cost in human time... OK.</span><br style="font-family: HelveticaNeue; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""></div></div></blockquote></div><br class=""><div class="">It's not like we'd hold an entire ceremony to generate a new root KSK, leave the room and go, "Whoops! Duplicate key tag! Better do that all over again!". Instead we'd just change the key generation code to look for key tag collections against a list of current/former/whatever keys and immediately generate another key if there's a collision.</div><div class=""><br class=""></div><div class="">Matt</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div></body></html>