Re: [eppext] Stephen Farrell's Discuss on draft-ietf-eppext-keyrelay-11: (with DISCUSS and COMMENT)

[Stephen Farrell <[e-mail]>]

On 17/12/15 15:59, Rik Ribbers wrote:
> Hello Stephen,
> 
> counter proposal:
> 
> 
> In this document we define an EPP extension to sent DNSSEC key material 
> between EPP clients. This allows DNS operators to bootstrap automatically, reliable and 
> securely the transfer of a domain name while keeping the DNSSEC chain of trust intact. 

So that doesn't address the exact point that confused me
which was that you're only defining how to do things in
one way where new public keys go from gaining -> losing.
That is the crucial point you need to make.

Secondly, acking that there are other ways in which it
can be done would be good too.

S.

> 
> Gr,
> Rik
> 
>> Ok, so it's option (a) which is fine. But don't you need to
>> say that in the document? I initially assumed you were doing
>> (b) which lead to a confusing read. I'd suggest adding a bit
>> of text like this near the start:
>>
>> "This specification describes a way to use EPP to allow a
>> gaining DNS operator to send new public keys to a losing
>> DNS operator. Having those new keys signed in the DNS before
>> transitioning to the gaining DNS operator means there need
>> not be any gap in service when new private keys (at the gaining
>> DNS operator) are used to sign DNS records. While there are
>> other ways of managing keys during transitions, only this
>> method is described in this specification."
>>
>> Cheers,
>> S.
>>
> 
>