Subject: [dnsext] this is a dnssec draft about compromised key

From: "张海阔" <[email-masked]>
Date: Tue, 06 Nov 2012 03:15:09 +0800

hello everyone here,
I wrote down and submitted a draft about compromised key roller over method, and hope it is useful to DNSSEC 
proposal
.
I am at Atlanta for the IETF 85 now, and I am willing to sit down 
and talk with people who are interested in my draft.
I hope people could pay more attentions to the problem of current emergency roll-over solution for compromised key,
because many other protocols depend on the DNSSEC, like TLSA and so on. 
The 
abstract
 of this draft is:
   DNS Security Extensions (DNSSEC) is widely deployed at TLD and other
   important domain names currently.  DNSSEC is an effective method to
   provide security protection for end users in the network.  DNSSEC
   needs a lot of operations to maintain the chain of trust, like DNSKEY
   rollover operations periodically.  But the chain of trust could be
   broken if the operator of domain replaces the old key immediately in
   a emergency rollover operation when the key is compromised.  The
   break will make the domain and his sub-domains invisible in a short
   time if the data in the cache of resolver is right, on the contrary,
   the fake RR in the cache of resolver may be "valid" if the resolver
   is under the attack from hackers.  This document introduces the
   compromised-key digest signature (CKDS) resource record to mitigate
   the impact of invalidation which is due to emergency rollover from
   the authoritative name server.
The IETF datatracker status page for this draft is:
http://www.ietf.org/internet-drafts/draft-haikuo-ckds-01.txt