Subject: [DNSOP] Last Call: <draft-ietf-dnsop-negative-trust-anchors-10.txt> (Definition and Use of DNSSEC Negative Trust Anchors) to Informational RFC

From: The IESG <[email-masked]>
Date: Tue, 09 Jun 2015 05:58:26 -0700

The IESG has received a request from the Domain Name System Operations WG
(dnsop) to consider the following document:
- 'Definition and Use of DNSSEC Negative Trust Anchors'
  <draft-ietf-dnsop-negative-trust-anchors-10.txt> as Informational RFC

The IESG plans to make a decision in the next few weeks, and solicits
final comments on this action. Please send substantive comments to the
[email-masked] mailing lists by 2015-06-23. Exceptionally, comments may be
sent to [email-masked] instead. In either case, please retain the
beginning of the Subject line to allow automated sorting.

Abstract

   DNS Security Extensions (DNSSEC) is now entering widespread
   deployment.  However, domain signing tools and processes are not yet
   as mature and reliable as those for non-DNSSEC-related domain
   administration tools and processes.  Negative Trust Anchors
   (described in this document) can be used to mitigate DNSSEC
   validation failures.

   [RFC Editor: Please remove this before publication.  This document is
   being stored in github at https://github.com/wkumari/draft-livingood-
   dnsop-negative-trust-anchors . Authors accept pull requests, and keep
   the latest (edit buffer) versions there, so commenters can follow
   along at home.]

The file can be obtained via
https://datatracker.ietf.org/doc/draft-ietf-dnsop-negative-trust-anchors/

IESG discussion can be tracked via
https://datatracker.ietf.org/doc/draft-ietf-dnsop-negative-trust-anchors/ballot/

No IPR declarations have been submitted directly on this I-D.

---

From: "Joe Abley" <[email-masked]>
Date: Tue, 09 Jun 2015 11:29:16 -0400

> <draft-ietf-dnsop-negative-trust-anchors-10.txt> as Informational RFC

I have read this document. The topic under discussion is a useful one, it is described clearly and well, and I support this document proceeding. I have some minor suggestions for improvement, but nothing substantial.

In section 1, the document uses normative-sounding language ("should not") and seems to direct the IANA not to do something. The normative-sounding direction is further extended to all other organisations. I understand the intent here, but the advice seems a little jarring; any IETF document can provide advice and recommendations without enforcement (informational documents arguably more so). Perhaps this could be rephrased to make it clear that the document is providing recommendations about how to implement and manage negative trust anchors rather than laying down the law.

In section 1.2 the document refers to a "domain administrator", when in the context of DNSSEC I think it means a "zone administrator".

In section 7 the document refers to "dnscheck", which I understand is no longer being maintained and has been replaced with "zonemaster". See <http://www.zonemaster.fr>, for example.

Joe

---

From: Warren Kumari <[email-masked]>
Date: Tue, 9 Jun 2015 13:35:19 -0400

> I have read this document. The topic under discussion is a useful one, it is described clearly and well, and I support this document proceeding. I have some minor suggestions for improvement, but n…

Whoohoo!

> In section 1, the document uses normative-sounding language ("should not") and seems to direct the IANA not to do something. The normative-sounding direction is further extended to all other organi…

I had a hard time trying to figure out how to address this. I changed:
"Negative Trust Anchors are intended to be temporary, and should not
be distributed by IANA or any other organization outside of the
administrative boundary of the organization locally implementing a
Negative Trust Anchor."
to:
"Negative Trust Anchors are intended to be temporary, and should only
be implemented by the organization requiring a Negative Trust Anchor
(and not distributed by any organizations outside of the
administrative boundary)."

I think that that changes the tone and doesn't sound as prescriptive /
jarring - does this address your concern?
I also skimmed the rest and didn't really find anywhere else to fix.

> In section 1.2 the document refers to a "domain administrator", when in the context of DNSSEC I think it means a "zone administrator".

Nice. Done. Thanks.

> In section 7 the document refers to "dnscheck", which I understand is no longer being maintained and has been replaced with "zonemaster". See <http://www.zonemaster.fr>, for example.

I replaced dnscheck with zonemaster. Initially I was just going to add
zonemaster (and leave dnscheck there), but seeing as .se is involved
in both projects I decided it was not impolite to remove their older
tool...

New version (with your suggested edits) pushed to github -
https://github.com/wkumari/draft-livingood-dnsop-negative-trust-anchors

Thank for your comments,
W

-- 
I don't think the execution is relevant when it was obviously a bad
idea in the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair
of pants.
   ---maf