[DNSOP]Re: Paul Wouters' Discuss on draft-ietf-dnsop-dnssec-bootstrapping-08: (with DISCUSS and COMMENT)

[[e-mail]]

On May 17, 2024, at 04:15, Paul Wouters <[e-mail]> wrote:

>>> Section 4.1.1:
>>> 
>>> It is not clear to me if the "signaling domain" really has to be
>>> its own zone or not. eg:
>>> 
>>> _dsboot.example.co.uk._signal.ns1.example.net
>>> 
>>> Could this be signed using the DNSKEY of "example.net", or does the
>>> document insist on a zone cut at _signal.ns1.example.net ?
>> 
>> The document does not insist that there be a zone cut.
> 
> So in that case, I think it would be more clear to rename "Signaling
> domain" to "Signaling name".

I think "signalling domain" is technically accurate; a domain is a namespace concept that is oblivious to the presence or absence of zone cuts. Using "domain" phrase neither requires a zone cut nor prohibits one, which is (AIBH) what is intended. The thing the phrase refers to is indeed a domain. "Signalling name" is much more vague to my eye. The term "name" can refer to many different things.

>> The Terminology section says:
>>    Signaling domain: A hostname from the child's NS RRset, prefixed
>>    with the label _signal.
> 
> Defining a hostname with an alias containing the word "domain" does not
> prevent the confusion though (as in my case of reading the document)

An alternative definition might be "a domain name constructed by prepending the label "_signal" to a hostname taken from the child's NS RRSet".


Joe