In Cairo, I was thinking of what we have written so far, and find that
the conclusions people draw from the text we have so far is not
consistent with what I think was said at the RIPE meeting in Dubai.
I will suggest text, but wanted to rise these two things asap:
- I did NOT hear at the RIPE meeting in Dubai any specific preference
for either of IANA or Verisign as the holder of any keys. That said, I
did hear some voices that felt "IANA is the natural trust anchor today
for the DNS namespace, and because of that they should also hold the
KSK". I did not hear any similar voice for Verisign.
- I have heard last week more voices that think one should look
carefully at the whole chain of trust from the TLD via the root to the
resolver. And point out the whole chain is important. This include at
where/when the zone is signed. I hear some people saying it is good if
the DS record passed from the TLD is signed as soon as possible (by
the organisation that receive the DS, today IANA).
To let the rubber hit the road: These _technical_ arguments argue for
a zone signing by the organisation receiving the DS, and therefore the
ZSK should be held by that organisation. This imply further a move of
the zone creation from Verisign to IANA.
So, I see the following alternatives being the dominant ones:
1. No change in the current structure. ZSK should be with Verisign as
Verisign is zone creator. KSK stays also with Verisign so that KSK and
ZSK are close to each other. Security of DS when moving DS from IANA
to Verisign is unclear, and trust chain from IANA (that we trust for
the root of the namespace) and the KSK that Verisign holds is unclear.
2. No change in the current structure. ZSK should be with Verisign as
Verisign is zone creator. KSK held by IANA. Namespace root and KSK
held by IANA, so trust chain is simple to see. Security of DS when
moving DS from IANA to Verisign is unclear.
3. Zone signing is with IANA, so IANA send signed records to Verisign.
This imply a change in the current structure as more than the record
changed is sent to Verisign (also NSEC etc). ZSK should be with IANA.
KSK held by IANA. Namespace root and KSK held by IANA, so trust chain
is simple to see. Security of DS is clear as it is signed when
received by IANA.
Then on top of this, we could have alternatives like whether the
"control over the keys" should be via some multiple-password systems
like suggested by Verisign, or split-key, or whether the community can
"simply" trust whoever is going to hold the keys (via open key
ceremonies etc).
I think my question is, should reply from RIPE list alternatives in a
way similar to this (I do not claim the above is perfect), so that it
is easier for "whoever make the decision" can count plusses and
minuses from their point of view? Something I think should be possible
already with the current list of bullets, if one just make some of the
points more clear and down to earth and not so much hand waving.
Patrik
