Subject: [DNSOP] [Technical Errata Reported] RFC6781 (5174)

From: RFC Errata System <[email-masked]>
Date: Sun, 29 Oct 2017 05:12:47 -0700 (PDT)

The following errata report has been submitted for RFC6781,
"DNSSEC Operational Practices, Version 2".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata/eid5174

--------------------------------------
Type: Technical
Reported by: Andreas Cudok <[email-masked]>

Section: Appendix B.

Original Text
-------------
   is reduced to the following representation:

            SOA_2005092303
            RRSIG_Z_14(SOA_2005092303)
            DNSKEY_K_14
            DNSKEY_Z_15
            RRSIG_K_14(DNSKEY)
            RRSIG_Z_15(DNSKEY)

Corrected Text
--------------
   is reduced to the following representation:

            SOA_2005092303
            RRSIG_Z_14(SOA_2005092303)
            DNSKEY_Z_14
            DNSKEY_K_15
            RRSIG_Z_14(DNSKEY)
            RRSIG_K_15(DNSKEY)

Notes
-----

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC6781 (draft-ietf-dnsop-rfc4641bis-13)
--------------------------------------
Title               : DNSSEC Operational Practices, Version 2
Publication Date    : December 2012
Author(s)           : O. Kolkman, W. Mekking, R. Gieben
Category            : INFORMATIONAL
Source              : Domain Name System Operations
Area                : Operations and Management
Stream              : IETF
Verifying Party     : IESG

---

From: Matthijs Mekking <[email-masked]>
Date: Mon, 30 Oct 2017 07:24:32 +0100

Hi,

This errata appears to be valid. In addition, the following text must 
also be corrected, from:

    The rest of the zone data has the same signature as the SOA record,
    i.e., an RRSIG created with DNSKEY_K_14.

to:

    The rest of the zone data has the same signature as the SOA record,
    i.e., an RRSIG created with DNSKEY_K_15.

Best regards,
   Matthijs

On 29-10-17 13:12, RFC Errata System wrote:
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
>

---

From: Warren Kumari <[email-masked]>
Date: Mon, 30 Oct 2017 17:08:20 -0400

Thanks! Verified.

W

On Mon, Oct 30, 2017 at 2:24 AM, Matthijs Mekking
<[email-masked]> wrote:
> Hi,
>
> This errata appears to be valid. In addition, the following text must also
> be corrected, from:
>

-- 
I don't think the execution is relevant when it was obviously a bad
idea in the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair
of pants.
   ---maf