Subject: Re: DNSEXT WGLC: Evaluating DNSSEC Transition Mechanisms

From: Peter Koch <[email-masked]>
Date: Fri, 10 Nov 2006 01:32:24 +0100

"Stuart E. Schechter" wrote (a long time ago):

> >> http://www.ietf.org/internet-drafts/draft-ietf-dnsext-dnssec-trans-04.txt
> 
> 2.1.1.4. Cons [of Dynamic NSEC Synthesis]
> 
>    The need to keep a signing key on the server is mentioned in 2.1.1.1, but
> should probably be explicitly mentioned in this Cons section.
> 
> 2.1.2.1.
>    "Since the Since the versioning is done inside the NSEC RR, different
> versions may coexist."
>    I'd add the words "within a zone" before the end of that sentence.

thanks, both have been fixed.

> 2.1.2.3
>    "while specifying behavior in case of" =>
>    "while specifying the recommended client behavior when presented with"

thanks, clarified.

>    "without versioning DNSSEC"
>       You are versioning a component of DNSSEC, which could be argued is
> versioning DNSSEC.  Perhaps something along the following lines would be
> more accurate: "without introducing versioning into other components of
> DNSSEC"

thanks, the text has been revised.

> 2.1.3.1.
>   "NXT, NSEC, RRSIG or other outdated RR types"
>      RRSIG is outdated?

yep, typos.

> 2.1.6.5. "Official version of the 'trick' presented in Section 2.1.5."
>    I think you mean to say that it is an formal and explicit indication
> mechanism that obtains the same ends as the informal mechanism (hack)
> described in 2.1.5.

You're right, this assessment was wrong. We (editors) have changed this
section accordingly.

> 2.1.7.1.4.
>    Isn't one of the Cons the performance of online signing each denial of
> existence record?  Potential denial of service attack?

This should already be covered by the term "all security impolications".

Thanks for your comments. Changes have been applied in coordination with the
WG chairs dealing with the WGLC summary. Please expect a new version to be
published the next days.

-Peter

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>