North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: America takes over DNS

  • From: David Conrad
  • Date: Mon Apr 02 10:54:14 2007

Hi,

Wouldn't the holder of these keys be the only ones able to spoof DNSSEC?

Yes. This is an assumption of DNSSEC, regardless of who signs the root. The implication of this (and the fact that emergency key rollover requires everyone on the planet with a validating resolver to update the root trust key manually) is that protecting the root key signing key is a bit important.

Rgds,
-drc