Subject: Re: [DNSOP] I-D Action: draft-ietf-dnsop-rfc4641bis-08.txt

From: John Dickinson <[email-masked]>
Date: Fri, 9 Dec 2011 11:44:22 +0000

Hi,

I realise that the focus of the document is on serving authoritative DNS information. However, could it say a bit more about validator operators. 

In particular, is there any good reason why validators should ever have their TA configured in a non-RFC5011 state (i.e. using trusted-keys clause in BIND or trust-anchor-file or trust-anchor clauses in Unbound)?

Since there is no RFC5011 signalling mechanism, validator operators should always assume that the TA may be under RFC5011 control and always use the managed-keys clause in BIND or auto-trust-anchor-file clause in Unbound.

Or am I missing something?

John
 
On 31 Oct 2011, at 10:33, [email-masked] wrote:

> A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Domain Name System Operations Working Group of the IETF.
> 
> 	Title           : DNSSEC Operational Practices, Version 2
> 	Author(s)       : Olaf M. Kolkman
>                          W. (Matthijs) Mekking

---
[email-masked]
Sinodun Internet Technologies Ltd.
Stables 4, Suite 11,
Howbery Park,
Wallingford,
Oxfordshire,
OX10 8BA,
U.K.

+44 (0)1491 834957

---

From: Peter Koch <[email-masked]>
Date: Tue, 13 Dec 2011 06:44:58 +0100

John, all,

> In particular, is there any good reason why validators should ever have their TA configured in a non-RFC5011 state (i.e. using trusted-keys clause in BIND or trust-anchor-file or trust-anchor claus…

thanks for your suggestion.  The PROTO writeup for 4641bis is in the makings and
the WG has reached consensus concerning the scope and content of the draft, therefore
it is too late now to add another aspect, also given the considerable length of
the document.

> Since there is no RFC5011 signalling mechanism, validator operators should always assume that the TA may be under RFC5011 control and always use the managed-keys clause in BIND or auto-trust-anchor…

I'd suggest we discuss this in a different thread.

-Peter

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 13 Dec 2011 07:02:08 -0800

On Dec 12, 2011, at 9:44 PM, Peter Koch wrote:

> The PROTO writeup for 4641bis is in the makings and

Process point: it is only too late to add to the scope or content of the draft until after the IESG has approved it as an RFC. The PROTO writeup comes before AD evaluation; the AD can (and often does) say "please add discussion of this topic that you left out; only then will I move it to IETF Last Call". Further, during IETF Last Call, it is quite appropriate for community members to say "the document doesn't cover Topic A, and it should"; the AD then decides whether or not to ask the WG to do so.

Yes, this document is years late. However, if there is relevant topic that is not covered, the history of lateness is not a good enough reason to ignore it.

Personal opinion: how validators work is very relevant to this document, and very important to have in a BCP as soon as possible.

--Paul Hoffman

---

From: Matthijs Mekking <[email-masked]>
Date: Thu, 22 Dec 2011 12:00:18 +0100

Hi,

While I agree that it is important to have a similar informational
document for validators, I believe that it should not be part of
4641bis, given its length. Also, The working group has decided to put it
in a separate document during the meeting at IETF78.

Best regards,
  Matthijs

On 12/13/2011 04:02 PM, Paul Hoffman wrote:
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 22 Dec 2011 06:54:03 -0800

> in a separate document during the meeting at IETF78.

Sorry, I forgot that decision. It is not reflected in the charter, and I don't see any WG drafts that cover the topic. Which draft is doing so?

--Paul Hoffman

---

From: Matthijs Mekking <[email-masked]>
Date: Thu, 22 Dec 2011 16:57:27 +0100

I believe work on such a document has not yet started.
The decision is logged in the minutes of the dnsop wg meeting at ietf78:

http://tools.ietf.org/wg/dnsop/minutes?item=minutes78.html

Best regards,
  Matthijs

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 22 Dec 2011 10:26:08 -0800

> http://tools.ietf.org/wg/dnsop/minutes?item=minutes78.html

Noted. The WG decided well over a year ago that this topic would be short but should be in a different document. That document has not be started. Can the chairs maybe take action on it soonish? From the minutes that Matthijs points to, there were lots of people in the room whom could use the guidance.

--Paul Hoffman