Re: [DNSOP] draft-yoneya-dnssec-kskro-failure-recovery-01

[Yoshiro YONEYA <[e-mail]>]

Hi,

On Wed, 05 Sep 2012 13:20:10 -0400 Michael StJohns <[e-mail]> wrote:

> Hi -
> 
> As the subject document seems to describe an operations problem rather 
> than a protocol problem, I'm going to use the dnsop mailing list to post 
> some comments.

Thank you for bringing this to dnsop mailing list.

> While I haven't completely internalized this document, I'm pretty sure 
> it's addressing the wrong problem.  The issue is not that there are too 
> many DS in the parent zone as compared to DNSKEY in the child.  It's 
> actually perfectly correct to publish a DS record in advance of 
> publishing the related DNSKEY.   I *think* the issue they may be 
> concerned with is a complete disjunction between the parent DS and child 
> DNSKEY RRSets.  But that's not what the document says.

Disjunction between DS and DNSKEY will happen.  That is premise of 
the document.  And the document (at least, one of the authors) is 
intent to indicate rational procedure to recover from the validation 
failure caused by the disjunction as soon as possible.

> Case 1 - there is no such thing as a failing DS.   There is a DS that 
> does not currently match a child DNSKEY, but that is not necessarily a 
> "fail".  Case 1 - the appropriate problem is "no matching DS for zone 
> DNSKEYs" - the resolution is "add a matching DS to the parent zone, or 
> deploy a DNSKEY that matches an existing DS".
> 
> Case 2-5 seem to be the same problem as case 1, rather than separate 
> problems - but the title of the cases does not reflect this.  In any 
> event, "removal" of data is mostly not going to help the problem - you 
> need to "add" the appropriate links in the trust chain.  Data that does 
> not provide a link in a trust chain is just extraneous and may be safely 
> ignored until it can be removed with normal practices.

Case 1-5 are alternate countermasures in case of disjunction has 
happened.  Of course, add appropriate DS in parent zone is correct 
way to recover the disjunction.  However, if DS is corrected, zone 
banishing may remain until DS cache is expired in validators.  This 
duration will take huge impact to the internet users.  As described 
above, the document is intent to indicate rational procedure to shorten 
the duration.

> At best this is an incomplete ID (and I'd recommend not posting 
> something this incomplete), at worst it's headed in the wrong direction.

Indeed, the document is imcomplete, and need feedbacks from experiences. 

Regards,

-- 
Yoshiro YONEYA <[e-mail]>