Subject: [DNSOP] review of draft-ietf-dnsop-dnssec-trust-anchor-01

From: Matthijs Mekking <[email-masked]>
Date: Tue, 25 Mar 2008 14:33:00 +0100

Hi,

I volunteered to review this draft, and have some minor comments:

1. In section 4 it says that trust anchors correspond to KSKs. My
understanding is that trust anchors correspond to both KSKs and ZSKs.
I also made this comment on my review of
draft-gudmundsson-life-of-dnskey-00.

2. Some must/should/SHOULD/MUST issues:
* page 6:
  "A validating resolver *should* remove a trust anchor that has been
  revoked as indicated by the REVOKE bit in the corresponding DNSKEY
  record as described in RFC 5011."
  : I argue if this 'should' should be a 'SHOULD' :), in order to
    indicate the requirement level as described in RFC 2119.
* page 7:
  "Validating resolver operators *MUST* ensure that configured trust
   anchors remains current and does not go stale."
  : This 'MUST' must be a 'must'. Well, at least I find it strange to
    use a keyword for the work of (human) operators.
  "each configured trust anchor *SHOULD* correspond to a DNSKEY RR in
   the trust anchor zone's apex DNSKEY RRSet."
  : SHOULD -> should. I think this refers to 'ought to' and not the 2119

    definition.

3. In section 5 it says that if multiple mechanisms are updating the
trust anchor list then there is the possibility of conflict, ...
So this setting is NOT RECOMMENDED? Maybe add such a sentence.

4. If you're using RFC 2119 keywords, maybe a section 'requirements
language' should be provided.

That's all!

Matthijs Mekking
[email-masked]
Foundation NLnet Labs
_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop