Subject: [DNSOP] Fwd: FW: New Version Notification for draft-mglt-dnsop-dnssec-validator-requirements-07.txt

From: Daniel Migault <[email-masked]>
Date: Sat, 23 Mar 2019 10:10:24 -0400

Hi,

We would particularly appreciate to share your thoughts and discuss the
requirements to operate DNSSEC validators. In particular, feed backs from
operators or implementers would be more than welcome. Please feel free to
share your thoughts on the mailing list, or let me know if there is a time
slot available to discuss them. Would Monday during the lunch break
convenient for you ?

Yours,
Daniel

---------- Forwarded message ---------
From: Daniel Migault <[email-masked]>
Date: Wed, Nov 28, 2018 at 1:18 PM
Subject: [DNSOP] FW: New Version Notification for
draft-mglt-dnsop-dnssec-validator-requirements-07.txt
To: dnsop <[email-masked]>

Hi,

Please find an updated version of the DNSSEC validator requirements
document. The document reflect discussions we had in the Montreal and
Bangkok meeting.
In particular we describe the DNSSEC trust model. We suppose that is an
important piece DNSSEC resolver operators needs to understand.  We reduce
the number of requirements to remain more aligned with the DNSSEC
architecture.  Overall the document seems reasonable to us.

Feed backs are always welcome!

Yours,
Daniel

-----Original Message-----
From: [email-masked] <[email-masked]>
Sent: Wednesday, November 28, 2018 1:02 PM
To: Edward Lewis <[email-masked]>; Daniel Migault <
[email-masked]>; Dan York <[email-masked]>
Subject: New Version Notification for
draft-mglt-dnsop-dnssec-validator-requirements-07.txt

A new version of I-D, draft-mglt-dnsop-dnssec-validator-requirements-07.txt
has been successfully submitted by Daniel Migault and posted to the IETF
repository.

Name:           draft-mglt-dnsop-dnssec-validator-requirements
Revision:       07
Title:          DNSSEC Validator Requirements
Document date:  2018-11-28
Group:          Individual Submission
Pages:          17
URL:
https://www.ietf.org/internet-drafts/draft-mglt-dnsop-dnssec-validator-requirements-07.txt
Status:
https://datatracker.ietf.org/doc/draft-mglt-dnsop-dnssec-validator-requirements/
Htmlized:
https://tools.ietf.org/html/draft-mglt-dnsop-dnssec-validator-requirements-07
Htmlized:
https://datatracker.ietf.org/doc/html/draft-mglt-dnsop-dnssec-validator-requirements
Diff:
https://www.ietf.org/rfcdiff?url2=draft-mglt-dnsop-dnssec-validator-requirements-07

Abstract:
   The DNS Security Extensions define a process for validating received
   data and assert them authentic and complete as opposed to forged.

   This document describes what is needed in implementations to make the
   validation process manageable Considerations for accurate time as
   well as management of the trust anchor store.

Please note that it may take a couple of minutes from the time of
submission until the htmlized version and diff are available at
tools.ietf.org.

The IETF Secretariat

_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

---

From: Daniel Migault <[email-masked]>
Date: Sun, 24 Mar 2019 13:45:43 +0100

We received positive feed back for Monday. So we will meet in the main
lobby at 12:20 during the lunch break. See you there!
Yours
Daniel

---

From: S Moonesamy <[email-masked]>
Date: Sun, 24 Mar 2019 07:38:52 -0700

Hi Daniel,
At 07:10 AM 23-03-2019, Daniel Migault wrote:
>We would particularly appreciate to share your thoughts and discuss 
>the requirements to operate DNSSEC validators. In particular, feed 
>backs from operators or implementers would be more than welcome. 
>Please feel free to share your thoughts on the mailing list,

I took a quick look at the draft.  The reference for RFC 7598 might 
be a typo [1].

Section 6.1.1:

   "Because of this, it is recommended that implementations make the root
    zone trust anchor obvious to the operator while still enabling
    configuration of general trust points."

The meaning of "obvious" in the above sentence might not be that obvious.

Section 6.2 discusses about a data store and references RFC 5011 as a 
requirement [2].  I read a comment [3] about RFC 5011 in which one of 
the assumptions of that RFC is mentioned: "The resolver has access to 
persistent writeable storage that will work across reboots".  I am 
not sure whether that is usually the case for unmanaged devices.

Section 8:

   "In order to anticipate the sunset of one of the signature scheme,
    a DNSSEC validator may willing to estimate the impact of deprecating
    one signature scheme."

The sentence is not clear.

As an overall comment, I suggest considering whether the audience is 
the average working group participant only.  If that is not the case, 
the draft could do with an editorial pass.

Regards,
S. Moonesamy

1. I assume that it is RFC 7958.
2. The sentence actually makes a recommendation.
3. 
https://blog.cloudflare.com/its-hard-to-change-the-keys-to-the-internet-and-it-involves-destroying-hsms/