[saag] RFC 5011 to IS question

[Stephen Farrell <[e-mail]>]

Hi,

The IESG recently are considering a request to move
RFC 5011 [1] to Internet Standard. This is a fine RFC
but I have one question and I'd be interested if
anyone here has input.

Should we re-think any of the timer values here in
the light of the fact that it took a few weeks to
find out about diginotar?

In particular the 30 day add hold-down timer might
arguably be better off at ~90 days if additions are
planned well ahead of time and there are no bad side
effects of a longer timer and we assume that gossipy
protocols might detect bad new trust points in a few
weeks, but not necessarily sooner. (Say if detection
needed a clueful traveller to go to place X, see the
bad new trust point and return to somewhere where the
bad new trust point isn't seen.)

I think the answer is "its still ok" and plan to
remove my discuss on this shortly, but wanted to
check in case others who know more about DNSSEC
think differently. (Note - nobody brought this up
during IETF LC, its just me asking.)

Thanks,
S.

[1] http://tools.ietf.org/html/rfc5011