Subject: review of draft-gudmundsson-life-of-dnskey-00.txt

From: Matthijs Mekking <[email-masked]>
Date: Wed, 19 Mar 2008 15:12:46 +0100

Hi,

I read this draft and have some comments:

"To large extent this discussion is motivated by Trust anchor keys but
the same terminology can be used for zone signing keys."
   I always interpreted that DNSKEY records (KSK and ZSK) could always
be used as trust-anchors. Anyway, in RFC 4033 and 4986 they make no
distinction in the trust anchor definition, so why make the distinction
here?

Retired: "When the key is no longer used for signing the zone it enters
state Retired."
   Maybe you can elaborate on when a key is no longer used. I think it
is when the key became 'the old key' during a rollover. Are there any
other cases?

Am I right if I say: "An expired key is always a retired key, but a
retired key does not have to be expired."?

Lame TAs: "A Trust Anchor is arguably Lame if there are no signatures by
a Retired KSK in the zone."
   TA is lame if the parent continues to publish DS pointing to the key,
after it has been removed from the DNSKEY RRset. Does it make difference
if there are signatures in the zone or not?

Regards,

Matthijs Mekking
[email-masked]
NLnet Labs Foundation

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>