<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style>
</head>
<body class='hmmessage'>
Hello,<br><br>in RFC5011, section 6.6, "Trust Point Deletion" (== KSK rollover),<br>there is an unconditional statement to set the REVOKE bit on the "old" KSK, once the parent zone publishes the DS record of the new KSK.<br><br>I / we at EURId / are interested to learn if this unconditional setting of the revocation bit is generally considered as best practice ?<br>This, in my opinion, adds more complexity for the administrator of DNSSEC zones.<br><br>Isn't it enough to use the revoke bit only in case of an actual/suspected compromise ?<br><br>Your comments are welcome !<br><br>Kind regards,<br><br>Marc Lampo<br><br><br>--- Security Officer for EURid --- http://www.linkedin.com/pub/dir/Marc/Lampo<br><br> </body>
</html>