[secdir] Review of draft-ietf-dnsop-rfc4641bis-12

Shawn Emery <shawn.emery@oracle.com> Tue, 28 August 2012 07:23 UTC

Return-Path: <shawn.emery@oracle.com>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (localhost []) by ietfa.amsl.com (Postfix) with ESMTP id 6E3A311E80BF; Tue, 28 Aug 2012 00:23:40 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.598
X-Spam-Status: No, score=-10.598 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([]) by localhost (ietfa.amsl.com []) (amavisd-new, port 10024) with ESMTP id fY0msT9ROupF; Tue, 28 Aug 2012 00:23:40 -0700 (PDT)
Received: from rcsinet15.oracle.com (rcsinet15.oracle.com []) by ietfa.amsl.com (Postfix) with ESMTP id E21DB11E808D; Tue, 28 Aug 2012 00:23:39 -0700 (PDT)
Received: from ucsinet21.oracle.com (ucsinet21.oracle.com []) by rcsinet15.oracle.com (Sentrion-MTA-4.2.2/Sentrion-MTA-4.2.2) with ESMTP id q7S7NcBk001288 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Tue, 28 Aug 2012 07:23:39 GMT
Received: from acsmt357.oracle.com (acsmt357.oracle.com []) by ucsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id q7S7NbYo021198 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 28 Aug 2012 07:23:37 GMT
Received: from abhmt105.oracle.com (abhmt105.oracle.com []) by acsmt357.oracle.com ( with ESMTP id q7S7NarS029372; Tue, 28 Aug 2012 02:23:37 -0500
Received: from [] (/ by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 28 Aug 2012 00:23:36 -0700
Message-ID: <503C71A4.30709@oracle.com>
Date: Tue, 28 Aug 2012 01:22:12 -0600
From: Shawn Emery <shawn.emery@oracle.com>
User-Agent: Mozilla/5.0 (X11; SunOS i86pc; rv:10.0.6esrpre) Gecko/20120731 Thunderbird/10.0.6
MIME-Version: 1.0
To: secdir@ietf.org
References: <50065F08.1090307@oracle.com>
In-Reply-To: <50065F08.1090307@oracle.com>
Content-Type: multipart/alternative; boundary="------------030901080104060804000009"
X-Source-IP: ucsinet21.oracle.com []
Cc: iesg@ietf.org, draft-ietf-dnsop-rfc4641bis.all@tools.ietf.org
Subject: [secdir] Review of draft-ietf-dnsop-rfc4641bis-12
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/secdir>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 28 Aug 2012 07:23:40 -0000

I have reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the IESG. 
These comments were written primarily for the benefit of the security 
area directors. Document editors and WG chairs should treat these 
comments just like any other last call comments.

This informational draft describes the operational practices for 
administrating a DNSSEC environment.  Specifically the management of 
keys and signatures in DNS.  The draft intends to obsolete RFC 4641.

The security considerations section does exist and is somewhat terse in 
its explanation of mitigating spoofing and DoS attacks.  This should be 
expanded or at least a reference made.

General comments:


Editorial comments:

Consistency: SEP is expanded, but not DS.

s/purposes X will somewhere/purposes, X will be somewhere/
s/such as e.g.  RFC 5011/e.g. RFC 5011/