Automated Updates of DNS Security (DNSSEC) Trust Anchors
RFC 5011

Approval announcement
Draft of message to be sent after approval:

Announcement

From: The IESG <iesg-secretary@ietf.org>
To: IETF-Announce <ietf-announce@ietf.org>
Cc: Internet Architecture Board <iab@iab.org>,
    RFC Editor <rfc-editor@rfc-editor.org>, 
    dnsext mailing list <namedroppers@ops.ietf.org>, 
    dnsext chair <dnsext-chairs@tools.ietf.org>
Subject: Protocol Action: 'Automated Updates of DNSSEC Trust 
         Anchors' to Proposed Standard 

The IESG has approved the following document:

- 'Automated Updates of DNSSEC Trust Anchors '
   <draft-ietf-dnsext-trustupdate-timers-07.txt> as a Proposed Standard

This document is the product of the DNS Extensions Working Group. 

The IESG contact persons are Mark Townsley and Jari Arkko.

A URL of this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-dnsext-trustupdate-timers-07.txt

Ballot Text

Technical Summary
 
The document describes a means for automatically updating public
keys that are configured in DNSSEC aware resolvers. New
trust-anchors are configured when signatures over them can be
validated using the previous trust-anchors. By introducing explicit
revocation and a delay mechanism the chances of an attacker
introducing a mala fide trust-anchor after a key compromise are
mitigated, albeit not solved.
 
Working Group Summary
 
There is a broad consensus that this solution provides a workable
key-rollover. The working group is aware of IPR issues. There 
have been a number of well-documented reviews and comment on 
this document, please see the PROTO statement for a detailed
overview. 
 
Protocol Quality
 
There are no implementations yet. The chairs are aware of at least
1 and maybe 2 independent organizations that plan on
implementing. At least one implementer has done in-depth review
during last call.

The chairs are of the opinion that after implementations are
written there is probably millage in documenting operational
experiences.

Note to RFC Editor

Please append the following to the Security Considerations section: 

"Security considerations for trust anchor rollover not specific to
this protocol are discussed in [ID.ietf-dnsext-rollover-requirements]"

and add this to the informative references:

[ID.ietf-dnsext-rollover-requirements]
         Eland, H., Mundy R., Crocker, S., and S. Krishnaswamy,
         "Requirements related to DNSSEC Trust Anchor Rollover",
         draft-ietf-dnsext-rollover-requirements-04
         (work in progress), November 2006.

RFC Editor Note