Subject: [DNSOP] Roman Danyliw's No Objection on draft-ietf-dnsop-algorithm-update-08: (with COMMENT)

From: Roman Danyliw via Datatracker <[email-masked]>
Date: Wed, 10 Apr 2019 08:30:05 -0700

Roman Danyliw has entered the following ballot position for
draft-ietf-dnsop-algorithm-update-08: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-dnsop-algorithm-update/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

(1) Abstract.  Nit.  There is a reference, [RFC6944], in the abstract which
isn’t permitted.

(2) Section 1.2, Per “This document only provides recommendations with respect
to mandatory-to-implement algorithms or algorithms so weak that recommendation
cannot be recommended”

** Editorial:
s/algorithms so weak that recommendation cannot be recommended/
algorithms so weak that they cannot be recommended/

** The first part of the sentence doesn’t appear to be consistent with the
RFC2119 words in the Section 3.1 Table which also includes RECOMMENDED/MAY
(which is neither MTI or NOT RECOMMENDED)

(3) Section 1.3, Typo, s/from from/from/

(4) Section 3.1, Typo, s/cryptographics/cryptographic/

(5) Section 3.1, ED448 appears to be the only algorithm that doesn’t have
treatment in even briefly describing its designated implementation
recommendation.

(6) Section 3.1, The sentence “It is expected that ED25519 will become the
future RECOMMENDED default algorithm …” is clear on the future.  However,
looking back at the table in this section, it wasn’t clear what the current
default algorithm is.

(7) Section 3.2, The sentence “Operation recommendation for new and existing
deployments.” Seems to stand alone or is missing some words.  Should it be
something along the lines of “This section provides operational recommendations
…”

(8) Section 3.2, Typo, s/is RECOMMENDED/is the RECOMMENDED/

(9) Section 3.4, Editorial, s/The SHA-256/SHA-256/

(10) Section 4, Typo, s/seciton/section/

(11) Section 5, Editorial, s/for the use of DNSSEC/for use in DNSSEC/

---

From: Paul Wouters <[email-masked]>
Date: Wed, 10 Apr 2019 18:49:12 +0200

Thanks for the review!

Hmm, it is really just giving a clickable reference to the document we are
obsoleting. It's kind of nice to have there. But I guess you are right that
it is not allowed, so I've made the text without a reference.

> algorithms so weak that they cannot be recommended/

Was fixed in -08

> (which is neither MTI or NOT RECOMMENDED)

It is recommended in lower case, not in 2119 meaning?

> (4) Section 3.1, Typo, s/cryptographics/cryptographic/

Were already fixed.

> treatment in even briefly describing its designated implementation

It does get mentioned in the beginning of the paragraph. But there isn't
much to say really. It's there but just slightly stronger than 25519, so
not really worth the effort. I think it is okay to leave it as motsly
uninteresting, but if someone has some text, I'm fine with that too.

> looking back at the table in this section, it wasn’t clear what the current

I've changed it a little bit to indicate this by adding a sentence here:

          RSASHA256 is in wide use and considered strong. It has been the
default
          algorithm for a number of years and is now slowly being replaced
with
          ECDSAP256SHA256 due to its shorter key and signature size,
resulting in
          smaller DNS packets.

> something along the lines of “This section provides operational

I've removed the sentence.

> (9) Section 3.4, Editorial, s/The SHA-256/SHA-256/

Were already fixed in -08.

> (10) Section 4, Typo, s/seciton/section/

Fixed.

Fixed.

The -09 should appear shortly with these fixes.

Thanks!

Paul

---

From: Roman Danyliw <[email-masked]>
Date: Fri, 12 Apr 2019 12:56:51 +0000

Hi!

From: Paul Wouters [mailto:[email-masked]]
Sent: Wednesday, April 10, 2019 12:49 PM
To: Roman Danyliw <[email-masked]>
Cc: The IESG <[email-masked]>; [email-masked]; Tim Wicinski <[email-masked]>; [email-masked]; [email-masked]
Subject: Re: Roman Danyliw's No Objection on draft-ietf-dnsop-algorithm-update-08: (with COMMENT)

Thanks for the review!

On Wed, Apr 10, 2019 at 5:30 PM Roman Danyliw via Datatracker <[email-masked]<mailto:[email-masked]>> wrote:

Hmm, it is really just giving a clickable reference to the document we are obsoleting. It's kind of nice to have there. But I guess you are right that it is not allowed, so I've made the text without a reference.

[Roman] Thanks.

** Editorial:

Was fixed in -08

[Roman] Thanks.

[Roman] Ok.  I didn’t read it like that.

Were already fixed.

It does get mentioned in the beginning of the paragraph. But there isn't much to say really. It's there but just slightly stronger than 25519, so not really worth the effort. I think it is okay to leave it as motsly uninteresting, but if someone has some text, I'm fine with that too.

          RSASHA256 is in wide use and considered strong. It has been the default
          algorithm for a number of years and is now slowly being replaced with
          ECDSAP256SHA256 due to its shorter key and signature size, resulting in
          smaller DNS packets.

[Roman] This is clearer.  Thanks.

Fixed.

Fixed.

[Roman]  Thanks so much for closing the loop on these and making the changes.

Thanks!

Paul