There was some discussion last month about dispersing trust in the root. http://www.ietf.org/mail-archive/web/dnsop/current/msg10977.html
This inspired me to write up a concrete proposal for the quorum-of-witnesses idea that I have vaguely suggested several times over the last few years. All thoughts / suggestions / criticisms welcomed. Tony. -- f.anthony.n.finch <[email protected]> http://dotat.at/ Forties, Cromarty: East, veering southeast, 4 or 5, occasionally 6 at first. Rough, becoming slight or moderate. Showers, rain at first. Moderate or good, occasionally poor at first. ---------- Forwarded message ---------- Date: Thu, 13 Feb 2014 12:50:35 -0800 From: [email protected] To: Tony Finch <[email protected]>, Tony Finch <[email protected]> Subject: New Version Notification for draft-fanf-dnsop-trust-anchor-witnesses-00.txt A new version of I-D, draft-fanf-dnsop-trust-anchor-witnesses-00.txt has been successfully submitted by Tony Finch and posted to the IETF repository. Name: draft-fanf-dnsop-trust-anchor-witnesses Revision: 00 Title: The WS resource record: dispersing trust in the DNSSEC root keys Document date: 2014-02-13 Group: Individual Submission Pages: 11 URL: http://www.ietf.org/internet-drafts/draft-fanf-dnsop-trust-anchor-witnesses-00.txt Status: https://datatracker.ietf.org/doc/draft-fanf-dnsop-trust-anchor-witnesses/ Htmlized: http://tools.ietf.org/html/draft-fanf-dnsop-trust-anchor-witnesses-00 Abstract: At the moment the root DNSSEC key is a single point of trust and a single point of failure for the whole system. This memo describes a mechanism for dispersing trust in the root key. Witnesses vouch for the root trust anchor by publishing WS records in the DNS. Validators only update their root trust anchors if multiple witnesses agree. The root-witnesses.arpa zone enables a validator to bootstrap trust when it has no working trust anchors other than its witnesses. Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. The IETF Secretariat _______________________________________________ DNSOP mailing list [email protected] https://www.ietf.org/mailman/listinfo/dnsop
