John Timmons at Ars Techinca wrote about the interorganizational wrangling beginning as .gov studies DNS fix. At issue: Who should implement and manage the root signing process rasises the question about who should hold the root keys to such a critical service. But my question is, why does the root zone need to be signed at all?
I hope plans to deploy DNSSec aren't slowed while ICANN, National Telecommunications and Information Administration (NTIA), and VeriSign hash out the details. As Timmons points out, there is a lot of wrangling going on that is important to address, but the root zone doesn't need to be signed for a successful global DNSSec deployment.
The trust in tree hierarchies like DNSSec and a public key infrastructure flows from a root to the leaves. Take a look at a hierarchy like VeriSign's, which has three PKI trees. The trust in each tree begins at the Class 1, 2, and 3 self-signed root certificate authorities. Those CAs are the trust anchors for each tree. All other public CAs have a similar structure where a self-signed root sits atop the tree and trust flows downward to the leaves. That flow of trust is the trust chain, which you can follow back to a trusted root. If you lookAmazon.com's digital certificate, it was issued by the VeriSign Class 3 Secure Sever CA, which was in turn signed by the VeriSign Class 3 Public Primary Certification Authority, which is the trust anchor.
The hierarchy in DNS is no different. There is a single root, the root zone, at the top of DNS that refers all queries to the top-level domain (TLD) servers. I recognize that DNS is a single tree where the plethora of public CAs are multiple trees, but that recognition simply demonstrates that a single trust anchor is unnecessary. The TLDs could be their own trust anchors, and the trust anchor signing keys could be distributed the same way thatCA certificates are distributed today, which is through software updates. Or a mechanism to update trust anchor signing keys could be distributed through DNS, making sure that keys don't expire before the new ones are distributed.
A singed root zone is a more elegant and potential efficient solution because there are fewer keys to update and can be managed through a single entity, but it's not necessary.
Source: informationweek.com/blog/main/archives/2008/10/we_dont_need_no.html
Posts
Hi !.
ReplyDeleteYou may , perhaps very interested to know how one can manage to receive high yields .
There is no need to invest much at first. You may commense to get income with as small sum of money as 20-100 dollars.
AimTrust is what you haven`t ever dreamt of such a chance to become rich
The firm represents an offshore structure with advanced asset management technologies in production and delivery of pipes for oil and gas.
Its head office is in Panama with offices everywhere: In USA, Canada, Cyprus.
Do you want to become a happy investor?
That`s your choice That`s what you wish in the long run!
I`m happy and lucky, I began to take up real money with the help of this company,
and I invite you to do the same. It`s all about how to select a correct partner who uses your money in a right way - that`s the AimTrust!.
I earn US$2,000 per day, and my first deposit was 1 grand only!
It`s easy to get involved , just click this link http://ugobobahy.freewebsitehosting.com/ozofiv.html
and lucky you`re! Let`s take our chance together to feel the smell of real money