Subject: [sidr] Operations Directorate Review of draft-ietf-sidr-keyroll-06

From: "Bert (IETF) Wijnen" <[email-masked]>
Date: Wed, 18 May 2011 10:22:14 +0200

[I am not subscribed to the sidr list, so pls copy me
explicitly if you want me to see any follow up or
responses].

As a member of the Operations Directorate I was asked to review
draft-ietf-sidr-keyroll-06 for it's operational impact.

It is clear that following procedures described in this document is
key to the proper operation of the routing system of the internet.

RFC5706 suggests but does not require a separate
"operational considerations section".

The draft-ietf-sidr-keyroll-06 discusses the operational considerations
in the "Security Considerations" section. I can live with that and leave it
to the OPS ADs if they rather see that split out in a separate section
or not.

Substantive comments/questions:

- last para on page 4

    During the transition of the "current" and "new" CA instances it is
    necessary for the "new" CA instance to re-issue all subordinate
    products of the "current" CA.  The procedure described here requires

    I wonder if the "requires" should be a "REQUIRES" (yep, I know that
    rfc2119 does not have that exact capitalized form of require, but I
    think that a MUST or REQUIRED is intended here, no?)?

- page 6
       4.  The NEW CA enters a Staging Period.  This duration of the
           Staging Period is determined by the CA, but it SHOULD be no
           less than 24 hours.
    Does/would it make sense to also suggest/recommend a max period?
    Would 48 hours make sense?

- given the first para in sect 1, I wonder if ID.ietf-sidr-arch should be
    a normative instead of a informative reference.

Editorial/nits:

- sect 1. 1st sentence
    This document describes an algorithm to by employed by a

    s/by/be/  (the first occurrence of "by")

- page 4, at top:
   CURRENT:
       The CURRENT CA is the active CA instance used to accept and
       process certificate issuance and revocation requests The starting

   s/requests/requests./

- page 5
    expand acronym CPS on its first use in this document.

- same for AIA acronym on page 6.

- page 6:
   4.  The NEW CA enters a Staging Period.  This duration of the

   s/This duration of the/The duration of this/

- page 8
    expand acronym CMS on its first use in this document.

Bert Wijnen