Last Call Review of draft-ietf-dnsop-dnssec-iana-cons-02
review-ietf-dnsop-dnssec-iana-cons-02-secdir-lc-harkins-2021-09-16-00
| Request | Review of | draft-ietf-dnsop-dnssec-iana-cons |
|---|---|---|
| Requested revision | No specific revision (document currently at 05) | |
| Type | Last Call Review | |
| Team | Security Area Directorate (secdir) | |
| Deadline | 2021-09-16 | |
| Requested | 2021-09-02 | |
| Authors | Paul E. Hoffman | |
| Draft last updated | 2021-09-16 | |
| Completed reviews |
Genart Last Call review of -04
by
Elwyn B. Davies
(diff)
Secdir Last Call review of -02 by Dan Harkins (diff) |
|
| Assignment | Reviewer | Dan Harkins |
| State | Completed | |
| Review |
review-ietf-dnsop-dnssec-iana-cons-02-secdir-lc-harkins-2021-09-16
|
|
| Posted at | https://mailarchive.ietf.org/arch/msg/secdir/8gQiIPytHmv4K28RMlzLw8iIT2g | |
| Reviewed revision | 02 (document currently at 05) | |
| Result | Has Nits | |
| Completed | 2021-09-15 |
review-ietf-dnsop-dnssec-iana-cons-02-secdir-lc-harkins-2021-09-16-00
Hello,
I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG. These comments were written primarily for the benefit of the
security area directors. Document editors and WG chairs should treat
these comments just like any other last call comments.
The summary of the review is "Ready with nits". The nits are:
- maybe it's the source or maybe it's datatracker, but there are two
references in section 1 (the first word of the 2nd and 3rd paragraph)
that should be hotlinked but aren't.
- the problem statement in section 1 is a bit confusing. It says that
"[RFC8126] gives guidelines for listing in the myriad IANA registries."
Full stop, end of paragraph. Then next paragraph it says how an earlier
document, RFC 6014, updated the requirements for how values in some
registries get assigned. So... 6014 didn't follow 8126 because it
didn't exist yet. So what's the point of mentioning 8126? Yes, it
lists guidelines...and? I don't think anything will be lost in the
draft if the entire 2nd paragraph of section 1 (the single sentence)
and its Normative Reference are removed. Suggest doing so.
- the Security Considerations should, I think, instruct the reader that
the burden for deciding between "good algorithms" and "bad algorithms"
belongs to the implementer/user now. There's a decision that now has
to be made-- it can't be passed off to the IETF and their Standards
Action-- and there are security considerations to that decision. I
suggest that be highlighted.
regards,
Dan.
--
"The object of life is not to be on the side of the majority, but to
escape finding oneself in the ranks of the insane." -- Marcus Aurelius