Re: [dnsext] WGLC: draft-ietf-dnsext-dnssec-bis-updates-16

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I have reviewed and support publication. Here are my comments.

1. Section 5.4. Caution About Local Policy and Multiple RRSIGs

1a. Nit
The second paragraph raises concerns when a resolver adopts a more
restrictive security policy. On the first read, it is not immediately
obvious why there can be unnecessary validation failures. Perhaps a
small explanation is needed, that the restrictive policy is requiring
all signatures to validate?

2. Section 5.11. Mandatory Algorithm Rules

2a. Nit
Typo: pressence -> presence

2b.
The section states that a signed zone MUST include a DNSKEY for each
algorithm present in the zone's DS RRset and expected trust anchors for
the zone. I argue if MUST is too strong, and would vote for SHOULD, for
the reason that the expected trust anchors and DS RRset are being
maintained outside the administrative boundaries of the zone owner.

3. Section 6.4. Erros in RFC 5155

I would like to see some clarifying or guiding text about the
contradiction in this RFC on the Flags field I posted earlier to this list:

Section 8.2 of RFC 5155 states that a validator MUST ignore NSEC3 RRs
with a Flag fields value other than zero or one. But in the IANA
Considerations section, bits 0-6 are available for assignment.

However, assigning a meaning to one of the bits 0-6 would break NSEC3
conformance because that would allow for Flag fields value larger than
one and that conflicts with the rule in Section 8.2 . As a result,
assigning a meaning to one of the bits 0-6 in the NSEC3 Flag fields
would require an update at the resolver side to ignore the bits it does
not implement, regardless of the total outcome value of the Flag fields.
Such a requirement allows for a more flexible approach for future
updates of the NSEC3 Flag fields, with a nice backwards compatibility
property.

Best regards,
  Matthijs
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJPKWfvAAoJEA8yVCPsQCW5XUEH/2IbCyR84dhWWp9qX5zI9tJ3
7YF9wwgd4i9a3IEtESQvyaFPWpvwTy0RnLOdG7XbataQcnf7URfJOQjIhjmuq+Lj
9Yk7DCIxyH6WNlGuAPaX7Lxq86HFO8BZDn5cdwHJtBljrZAN91HvHuazBuPw1xzc
3bf5+B9R/TfNO4shQw9sIdjNDgwm4lpW9P62X8MATk0P7tDnkLHgFbP8dug1kxes
yzMhoHO8CB/uwS6VrB1tIjoHaw1+QLYO99xXKWQ2778SuQobmASvz4iq4GE/FV/0
mQFuyy5eb5ilVerYGUQChRaHDlz7BsmzNZI17zSH8UW0/oEF/Sc3boOKiX3MrC8=
=xD3b
-----END PGP SIGNATURE-----
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext