need project review

[Jeffrey Hutzelman]

--On Monday, April 07, 2008 07:21:30 PM -0400 Ken Raeburn <raeburn at mit.edu> 
wrote:

>> 2) When you write a new master key, you recode the entire database.
>> This could be a very big operation, so you may want to just shut down
>> the KDC for the duration.  In turn this means you are depending on
>> client failover to other KDC's to maintain service availability.
>
># 2 is incompatible with the KDC using an automatically-replicated (or
> simply shared) LDAP service for data storage

Ew.  Don't do that. :-)

That said, I still prefer incremental transition to reencrypting the entire 
database in one operation.