Re: [secdir] review of draft-ietf-dnsext-dnssec-gost-05

[Jeffrey Hutzelman <[e-mail]>]

--On Thursday, February 11, 2010 11:29:55 AM -0500 Stephen Kent 
<[e-mail]> wrote:

> At 9:06 PM +0300 2/10/10, Basil Dolmatov wrote:
>>> ...
>> Good shift in modal verbs <girn>.
>> I am fully agree that implementations "ought to have" but not "must
>> have" a code.
>> This is the difference between MUST and SHOULD as I understand it.
>> If SHOULD is used then "it is advised to have a code", but you can
>> omit it (after "careful weighting") and still be compliant.
>> If MUST is used - then you must have a code, otherwise you are not
>> compliant. No options. Period.
>
> I think Andrew's characterization is better than mine, and his follow-up
> message to you provied good examples.
>
>> ...
>>> We're debating the issue of how broad a set of algorithms
>>> MUST/SHOULD be supported by RPs, which is an architectural (and
>>> political) issue.
>> Having no means to inform other side about algorithms used is the
>> thing that differs SIDR from DNSSec.
>
> I agree that there is a big difference between protocols where one can
> discover or negotiate protocol options and ones where this is not the
> case. But I believe that SIDR and DNESEC are pretty much the same in this
> respect. Both the RPKI and DNSSEC publish data that discloses what algs
> the publisher has chosen to employ. Relying parties either accommodate
> those choices or they do not make use of the signed data.
>
>>> ...
>>>
>>> I'm glad we agree on this. Since SHOULD is only a
>>> slightly-diminished form of MUST, ...
>> Either SHOULD is the synonym of MUST and then the question rises
>> what it is present for if there is no real difference between it and
>> MUST (it "should" <grin> be named as obsolete), or SHOULD has it's
>> own meaning and should not be treated in discussions as MUST
>> equivalent.
>
> See Andrew's message, to which Im alluded above.
>>> ...
>> I want to make a reservation that I am not native English speaking
>> person, so sometimes I use only literal meaning of the words when
>> writing (and reading).
>> In order to clarify I will use an example from my profession (I am a
>> physicist):
>>
>> Imagine that one astronomer will estimate the orbit of some comet
>> and say that "It is likely to hit the Earth".
>> Will it be the "threat" from the astronomer to the Earth? No, I
>> think that it will be just a "warning note", because the astronomer
>> have no influence on this process, he can only calculate the orbits
>> of comets.
>> Definitely, some people could say that "this astronomer threats us
>> with this comet", but it seems obvious that it is not the case. ;)
>
> OK. I'll interpret your comment as a comet warning :-).
>
>>
>>>> Maybe this is the way the DNS system will develop, but now I think
>>>> that the some effort to keep the DNS system united is justified.
>>>
>>> Unified is a goal we both agree upon, but mandated support for
>>> national algorithms is NOT a unifying principle, it is a
>>> Balkanizing principle (if you'll pardon the term).
>> I am not familiar with this term and once more I object against
>> putting the equal sign between MUST and SHOULD modal verbs.
>> I still think that there is a significant difference between them
>> which is worth keeping both of these verbs in the list of
>> instruments of IETF standards description.
>>
>> So, noone is talking about "mandated support" (which means MUST),
>> the bottom line is "to encourage support".
>
> MUST and SHOULD are not the same, but they are no so different as you
> seem to suggest.


It might be helpful for everyone to remember that while English has fairly 
loose definitions of "must" and "should", in this context MUST and SHOULD 
have precisely the meanings given them by RFC2119.  In particular, SHOULD 
is not mere advice or encouragement; it is a requirement almost as strong 
as MUST.  It doesn't mean "we think it's a good idea for you to do this"; 
it means "you absolutely have to do this unless...".

-- Jeff