[dnssec-key-tf] notes from today's discussion

Here are my notes from today's discussion. Please let me know if I  
have missed anything or misrepresented anyone's questions and opinions.

I will prepare some slides for the WG tomorrow and circulate them for  
comment and review to the TF before they go to the WG.

should we have a TAR?

         creating a trust hierarchy parallel to DNS is unwise
         takes pressure off ICANN to solve the later 9 problems

DFK - TAR may be moot considering IANA development

         experimental service for TLDs
         helpful to getting the root signed because it's homed at IANA

Richard Lamb

         IANA demo is a solid implementation
         serious effort
                 plan SLAs for slave servers
                 spent money on crypto hardware
         too early to say for future directions
                 still at an early evaluation phase
         hope to sign .arpa by ICANN meeting next week

         TLD operator can go to web site
                 tells IANA to fetch keys
                         fetch keys from DNS -- scp, SSL?
                 IANA generates DS records
                 TLD approves generated DS record before it goes into  
root
                 no authentication yet of TLD operator making the  
request

                 DFK - IANA must ensure request comes from real TLD  
operator
                 MS - leverage existing IANA relationships with TLDs
                 RA - will new kets be automatically picked up
                         no: IANA not considered yet
                 JD - ISC runs similar TAR
                         struggling with authenticating zone owner
                         ISC sends a cookie which zone owner must  
sign & publish
                 JD - IANA is the right place for this
                 JD will IANA system go beyond a demo?
                         RL - count on this for .arpa
                 JD IANA's intentions for a root management system
                         will effectively be a repository
                         hold tokens
                 LJL - consequences of tests with a signed root
                         could create a shadow/alternate root hierarchy
                         change relationships with existing root  
operators
         DFK - WG concerns that the TAR is stable and "permanent"
                 more assurances would help
         JR - what about the NCC acting as an escrow to IANA?
                 DFK - a cold standby service could be a good idea
                 JD concerns about commitment to renew the keys
                 LJL reponsibility for new keys lies with the child
                 DFK cold standby could archive TLD keys & flag changes
                 PK - I hear backup and hear contingency planning
                 When would standby be activated?
                 Should standby be harvesting keys while it is inactive?
         RL - trust anchors for TLDs only?
         LV who would use this?
                 concerns not to turn experimental service into  
production
                 must not give rise to a look and feel of an  
alternate root

DFK - how to answer Swedish request
         JD - publish but not through the DNS
         PK - could bypass the layer9 stuff to get the root signed
         LJL - more transparency from IANA/ICANN is needed


JR - how to answer Swedish request
         JD - ask NCC to study TAR
         RL - changing DS records on the fly rather than go through  
root process
         DK - NCC would entertain a request for a specification for a  
TAR
                 engage TF in reviewing the specification
                 included a clear direction to co-operate with IANA

JR what about publication method?
         DK best if it's not DNS
                 easily parseable format XML?
                 tools to churn out config files
                 avoid parallels with alternate roots
         MS deadlines?
                 JR put this into the specifications
         DK winding down must be defined from the outset

MS - what is the time-frame?
         DK can't speak to this until the WG request this
         JR - TF to recommend time scales
         	Spec end Jan
		TF to review by end Feb
		public comment on WG
		implementation by RIPE 56
         LJL - push responsibilities for keys to children