I think the line:

    After that DS RR has been
    published on all servers authoritative for the parent's zone, the
    zone administrator has to wait at least TTL_DS to make sure that
    the old DS RR has expired from caches.

Could be part of the 'DS change' step.

It qualifies as an errata IMHO.

Best regards,
Matthijs


On 04/26/2018 04:15 PM, Matthew Pounsett wrote:
I've found some confusing text in the KSK Rollover section of RFC 6781, and I'm trying to decide whether to submit it as errata.

In section 4.1.2, which describes the various steps in a KSK rollover, the following text is meant to describe the last three steps:

        new DNSKEY:  During the "new DNSKEY" phase, the zone administrator
           generates a second KSK, DNSKEY_K_2.  The key is provided to the
           parent, and the child will have to wait until a new DS RR has
    been
           generated that points to DNSKEY_K_2.  After that DS RR has been
           published on all servers authoritative for the parent's zone, the
           zone administrator has to wait at least TTL_DS to make sure that
           the old DS RR has expired from caches.

        DS change:  The parent replaces DS_K_1 with DS_K_2.

        DNSKEY removal:  DNSKEY_K_1 has been removed.


The text for the "new DNSKEY" step seems to contain text that belongs in the other two..  Even though rearranging it wouldn't change the meaning, it's not clear to me that this qualifies as simple errata.. it's obviously too big a change to just be fixing a typo.

Thoughts on whether I should submit it?

Or maybe we just put it on the pile of things that have come up recently that speak to a 6781-bis document.




_______________________________________________
DNSOP mailing list
DNSOP@ietf.org
https://www.ietf.org/mailman/listinfo/dnsop


_______________________________________________
DNSOP mailing list
DNSOP@ietf.org
https://www.ietf.org/mailman/listinfo/dnsop

Reply via email to