Subject: [secdir] SECDIR review of draft-ietf-dnsop-dns-zone-digest-11

From: Donald Eastlake <[email-masked]>
Date: Sun, 27 Sep 2020 22:50:56 -0400

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG. Document editors and WG chairs should treat these comments just
like any other last call comments.

The summary of the review is Ready with Nits.

Overall, I am pretty happy with the state of the draft. Essentially
all of the comments from my review of -09 have been resolved and I
don't see any problem with other changes that have been made. However,
on reviewing -11, I did come up with a few things as listed below.

Section 2, last sentence right before the Section 2.1 header, should
"recommended" be all capital?

Something I didn't notice in my first review:
Section 2.2.1, ZONEMD already covers the SOA that is in the zone and
so includes the zone serial in its Digest. Thus it seems a little odd
to say that the field is needed to make the DNS response meaningful.
I'm not suggesting removing the field or anything... Perhaps some
wording change like the following:
OLD
   It is included here in order to make DNS response messages of type
   ZONEMD meaningful.  Without the serial number, a stand-alone ZONEMD
   digest has no association to any particular instance of a zone.
NEW
   It is included here to clearly bind the ZONEMD RR to a particular
   version of the zone's content. Without the serial number, a
   stand-alone ZONEMD digest has no obvious association to any
   particular instance of a zone.

Section 3.1, last sentence just before the Section 3.2 header: This
says ZONEMD RRs are excluded from digest calculation but in Section
2.1 it says that non-apex ZONEMD RRs are treated are ordinary RRs and
included. I think that 2.1 is correct and suggest inserting the word
"apex" so the last sentence of Section 3.1 starts with "Since apex
ZONEMD RRs are excluded ..." Although less important, "apex" probably
should also be inserted before "ZONEMD" in the fourth and sixth bullet
points of Section 3.3.1.1.

Section 5.3, the last sentence, after the table, is no longer needed,
since that information is given above the table, so it should be
deleted.

Section 6.2: Need to expand KSK on first use or alternatively, since it
is the only use, just not use the acronym at all and spell it out in
full.

Section 6.3: Size estimate for ZONEMD RR seems a bit low, perhaps
based on algorithms in earlier versions of the draft with shorter
digests. I would say 55 to 85 octets would be a better current
estimate.

Section 6.4: In the second paragraph, I think you mean "private use
hash algorithm code points", not "private use hash algorithms".

That's it.

Thanks,
Donald
===============================
 Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
 2386 Panoramic Circle, Apopka, FL 32703 USA
 [email-masked]

---

From: "Wessels, Duane" <[email-masked]>
Date: Mon, 28 Sep 2020 22:54:10 +0000

> On Sep 27, 2020, at 7:50 PM, Donald Eastlake <[email-masked]> wrote:
> 

That change is fine with me.

>   particular instance of a zone.

I think that is an improvement.

> points of Section 3.3.1.1.

I don't mind inserting "apex" where you suggest.  I felt we were covered
by the earlier statement that ZONEMD means apex ZONEMD unless stated
otherwise, but its good to be explicit in those places.

> since that information is given above the table, so it should be

Yes.

> is the only use, just not use the acronym at all and spell it out in

Done.

> digests. I would say 55 to 85 octets would be a better current

Yes indeed.  I changed it to "65 to 95" now since the smallest SHA384 SIMPLE
RR is 65 bytes and a SHA512 SIMPLE RR for "example.com" is 93 bytes.

> hash algorithm code points", not "private use hash algorithms".

Yes, thats better.

> Donald

Thank you again.

DW

---

From: Donald Eastlake <[email-masked]>
Date: Tue, 29 Sep 2020 11:07:35 -0400

Hi Duane,

Thanks for being so agreeable. As soon as a new version is posted with
the changes I'll send out a message confirming that all my comments
are resolved.

Donald

---

From: Donald Eastlake <[email-masked]>
Date: Tue, 29 Sep 2020 17:30:34 -0400

Hi,

Looking at version -12, just posted, all of my comments are resolved
and I believe the draft is now READY for publication as an RFC.

Thanks,
Donald