Subject: [dnsext] draft-registry-fixes-05 posted

From: "Rose, Scott W." <[email-masked]>
Date: Fri, 18 Jun 2010 14:32:36 -0400

Just posted.  Simply to have something for people to beat against instead of trying to follow a bunch of deltas in an email thread.

Changes from -04:
1.  added terminology section
2.  added section 2.3 on status updating process
3.  Lists all the RFC's that this document will update
4.  cleaned up the IANA considerations section a bit

Scott

===================================
Scott Rose
NIST
[email-masked]
+1 301-975-8439
Google Voice: +1 571-249-3671
http://www.dnsops.gov/
===================================

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 18 Jun 2010 15:16:31 -0700

>4.  cleaned up the IANA considerations section a bit

Thanks for the update, but it still mostly fails to deal with the core issue of what the column in the table refers to.

The abstract says:
   The DNS Security Extensions (DNSSEC) has an IANA registry to allocate
   cryptographic algorithm suites for use in generating digital
   signatures over DNS data.  Newly introduced cryptographic algorithms
   to DNSSEC mean implementors need to know which algorithms need to be
   implemented, which are optional, and which are obsolete.  This
   document adds a column to the IANA registry table for Domain Name
   System Security (DNSSEC) Algorithm Numbers which lists their current
   status for use.
What does "need to be implemented" mean? As was discussed earlier, one only needs to implement an algorithm if they want to conform to a particular RFC, but that is not mentioned here. The same problem appears for "their current status for use". Anyone can implement "for use" to conform to the RFC in which the algorithm was defined, so this sentence is meaningless.

There is nothing in section 1 that clears this up. For example, 1.1 says:
      MANDATORY: Implementations MUST support this algorithm to be
      considered currently inter-operable.
Interoperable with what? The text is still broadly hinting at "interoperable with other DNSSEC implementations", which is just plain wrong.

--Paul Hoffman, Director
--VPN Consortium

---

From: "Rose, Scott W." <[email-masked]>
Date: Tue, 22 Jun 2010 11:18:05 -0400

> What does "need to be implemented" mean? As was discussed earlier, one only needs to implement an algorithm if they want to conform to a particular RFC, but that is not mentioned here. The same pro…
How about:

The DNS Security Extensions (DNSSEC) has an IANA registry to allocate
   cryptographic algorithm suites for use in generating digital
   signatures over DNS data.  Newly introduced cryptographic algorithms
   to DNSSEC (and algorithm migration) mean implementors need to know
   the status of algorithms according to the current RFC's.  This
   document adds a column to the IANA registry table for Domain Name
   System Security (DNSSEC) Algorithm Numbers which lists each
   algorithm's status based on the current reference.

> Interoperable with what? The text is still broadly hinting at "interoperable with other DNSSEC implementations", which is just plain wrong.

second half of first paragraph, section 1.1:

Throughout this text,
   "implementation" refers to any component (e.g. validator, signer,
   etc.) that conforms to this document.  Some of these terms were used
   without definition in previous documents and are defined here.

      MANDATORY: Implementations MUST support this algorithm to be
      considered conforming to the specification reference and this
      document.

Scott

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 22 Jun 2010 09:34:38 -0700

>   algorithm's status based on the current reference.

What does "the current reference" mean?

>      considered conforming to the specification reference and this

That would help immensely, but it still does not clear up what the IANA registry is supposed to say.

--Paul Hoffman, Director
--VPN Consortium