As I stated in the meeting, I think this document is a great idea as an
addition to the RFCs about DNS(SEC). Kudos for writing it, and great
kudos for the diagrams and generally clear text.
Comments though:
*** Biggest one: I still believe that this document would be horribly
remiss without including the timing associated with RFC5011
processing. It's becoming more and more clear that zone operators
will be encouraged by their registrars to roll they're keys in 5011
compliant manners for automatic DS or DLV record updates to succeed
without requiring conversation. The extra timing constraints
introduced by RFC5011 aren't nearly as bad as the timing constraints
in the draft, and thus I think the increase in complexity will only
be a small fraction of what is already a complex situation.
I think it could be best handled by simply including a section near
the top that defines one term that is included in all the needed
equations below. That term would be 0 if you weren't doing RFC5011
processing or would be something like 30days + fudge, for example,
if you were. That wouldn't require making the text below more
complicated but would still show the important points in the process
where longer wait times are necessary.
I think this is critical and must be included. IMHO, of course.
But I'll do my best to adapt everyone else's HO as well.
* mention the appendix early in the doc as a handy reference. i.e. it's
highly useful to refer to when reading the doc itself
* 2.1: Dp => time delay fudge factor. I think the text, by the time you
get to the bottom, adequately describes the issues with needing to
wait a period of time that is highly variable because of operational
delays. I'd be tempted (since I think it's a confusing point to many)
to bring it up in it's own paragraph before the rest of the math
begins. Discuss the issues with propagation and possibly mention that
some code bases just use a standard doubling to ensure the timing is
safe (e.g. instead of waiting for just a TTL, wait for 2*TTL instead).
* 2.2.2: I think the wording could be a clearer here. That being said,
I haven't done the decency of suggesting an alternative paragraph or
two have I? (Sorry).
* 2.2.2: and others: I'd be tempted to use a different event enumeration
system. Group each set of events together so when you switch from one
scenario to another users can be sure you're not talking about the
same event. My initial thought was to use events of the form A.1,
A.2, ... and then switch to B.1 ... when switching to a different
timing discussion.
* 2.3.1, last word: "events" -> "external triggers" or "other triggers"
("events" already has way too much context above and thus a different
word would be better just to ensure it's not confused with the
previous text; pick the synonym of your choice)
* For acronyms/terms/abbreviations like "Nze" you have defined as "the
(n)umber of (e)mergency (Z)SKs". Most of the terms suffer from a
battle in user memorization because the ordering of the words differs
from the ordering of the letters. It took me half the document to
realize why I wasn't remember what each term was. There is a
consistence to the abbreviations that makes sense, so I think it'd be
better to simply reorder the words instead. For example "Nze" could
be "the number of ZSKs for use in emergencies". (this is actually a
harder one; most of the rest of them have an easier wording/ordering
swap than this example)
* I'd strongly recommend, when you get everything further along and
about finished, that you hand it to someone fresh to have them check
all the equations from scratch. Some of them are complex enough that
I wouldn't be surprised if an thinking error snuck in (not that I
don't have confidence in you! To err is human).
* 3.1, bullets 2 and 3: technically ZSKs can be pointed to by a DS and
can be used as trust anchors. It would probably be easiest if
you declared that aspect out of scope as it isn't the recommend usage
case.
* 3.1, paragraph ending in "and its publication in the zone.)":
I'd list Dr instead as the "time between publication of the key and
the DS publication" because the timing of when the parent was informed
is not as important as the time between the key publication and the DS
publication. When it was published to the parent is almost certainly
different from when the key first got published.
--
"In the bathtub of history the truth is harder to hold than the soap,
and much more difficult to find." -- Terry Pratchett
_______________________________________________
DNSOP mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/dnsop
