Subject: 3 comments on timers-03

From: "Scott Rose" <[email-masked]>
Date: Wed, 26 Jul 2006 13:46:11 -0400

I have been reading the draft-timers-03, and I know there are other
comments, but I think these are unrelated.  2 are minor, one is a response
to a discussion point in the draft.

First the minor ones
1.  "resolver" is used several times when the actual component performing
the action would be the validator.

2.  Section 5.1 - the 5th step is "wait a while".  This step seems
unnecessary.  Or, if a time limit is really needed before any other
operation, the time could be the TTL of the DNSKEY RRset or the min TTL of
the SOA RR.  But I think it's unnecessary.

For the discussion point in section 4.2 (states).  In the "missing" state,
if a DNSKEY is removed from a RRset, it should be dropped as a trust anchor.
I don't know if there should be a wait of the "hold down" time or not.  If
the RRset validates and there is a trust anchor, then it is a mistake in the
rollover process and the missing trust anchor could be dropped.

If there is no trust anchor anymore (i.e. the only trust anchor is now
missing) - then there needs to be a timeout before dropping, just in case of
a man-in-the-middle dropping the DNSKEY RRset from messages.

Scott

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>