Last Call Review of draft-ietf-dnsop-dnssec-iana-cons-02
review-ietf-dnsop-dnssec-iana-cons-02-secdir-lc-harkins-2021-09-16-00

   Hello,

   I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

The summary of the review is "Ready with nits". The nits are:

   - maybe it's the source or maybe it's datatracker, but there are two
     references in section 1 (the first word of the 2nd and 3rd paragraph)
     that should be hotlinked but aren't.

   - the problem statement in section 1 is a bit confusing. It says that
     "[RFC8126] gives guidelines for listing in the myriad IANA registries."
     Full stop, end of paragraph. Then next paragraph it says how an earlier
     document, RFC 6014, updated the requirements for how values in some
     registries get assigned. So... 6014 didn't follow 8126 because it
     didn't exist yet. So what's the point of mentioning 8126? Yes, it
     lists guidelines...and? I don't think anything will be lost in the
     draft if the entire 2nd paragraph of section 1 (the single sentence)
     and its Normative Reference are removed. Suggest doing so.

   - the Security Considerations should, I think, instruct the reader that
     the burden for deciding between "good algorithms" and "bad algorithms"
     belongs to the implementer/user now. There's a decision that now has
     to be made-- it can't be passed off to the IETF and their Standards
     Action-- and there are security considerations to that decision. I
     suggest that be highlighted.

   regards,

   Dan.

-- 
"The object of life is not to be on the side of the majority, but to
escape finding oneself in the ranks of the insane." -- Marcus Aurelius