Subject: RFC 4641 errata

From: Alfred Hönes <[email-masked]>
Date: Fri, 13 Oct 2006 16:34:32 +0200 (MESZ)

Hello,
reading the recently published RFC 4641 (DNSSEC Operational Practices)
authored by you, I unfortunately found two distorting formatting
errors, and two typos as well:

(1)  ill-formatted table in Section 4.2.1.1

At mid-page 15, RFC 4641 says:

   Pre-publish key rollover involves four stages as follows:

      ----------------------------------------------------------------
      initial         new DNSKEY       new RRSIGs      DNSKEY removal
      ----------------------------------------------------------------
      SOA0            SOA1             SOA2            SOA3
      RRSIG10(SOA0)   RRSIG10(SOA1)    RRSIG11(SOA2)   RRSIG11(SOA3)

      DNSKEY1         DNSKEY1          DNSKEY1         DNSKEY1
      DNSKEY10        DNSKEY10         DNSKEY10        DNSKEY11
      DNSKEY11         DNSKEY11
      RRSIG1 (DNSKEY) RRSIG1 (DNSKEY)  RRSIG1(DNSKEY)  RRSIG1 (DNSKEY)
      RRSIG10(DNSKEY) RRSIG10(DNSKEY)  RRSIG11(DNSKEY) RRSIG11(DNSKEY)
      ----------------------------------------------------------------

                         Pre-Publish Key Rollover

It should say:

   Pre-publish key rollover involves four stages as follows:

      ----------------------------------------------------------------
      initial         new DNSKEY       new RRSIGs      DNSKEY removal
      ----------------------------------------------------------------
      SOA0            SOA1             SOA2            SOA3
      RRSIG10(SOA0)   RRSIG10(SOA1)    RRSIG11(SOA2)   RRSIG11(SOA3)

      DNSKEY1         DNSKEY1          DNSKEY1         DNSKEY1
      DNSKEY10        DNSKEY10         DNSKEY10        DNSKEY11
|                     DNSKEY11         DNSKEY11
      RRSIG1 (DNSKEY) RRSIG1 (DNSKEY)  RRSIG1(DNSKEY)  RRSIG1 (DNSKEY)
      RRSIG10(DNSKEY) RRSIG10(DNSKEY)  RRSIG11(DNSKEY) RRSIG11(DNSKEY)
      ----------------------------------------------------------------

                         Pre-Publish Key Rollover

Rationale: The mis-alignment of the indicated line breaks the intended
presentation of the procedure; cf. subsequent RFC text.

(2)  ill-formatted table in Section 4.2.1.2

At mid-page 17, RFC 4641 says:

   Double signature ZSK rollover involves three stages as follows:

      ----------------------------------------------------------------
      initial             new DNSKEY         DNSKEY removal
      ----------------------------------------------------------------
      SOA0                SOA1               SOA2
      RRSIG10(SOA0)       RRSIG10(SOA1)      RRSIG11(SOA2)
      RRSIG11(SOA1)

      DNSKEY1             DNSKEY1            DNSKEY1
      DNSKEY10            DNSKEY10           DNSKEY11
      DNSKEY11
      RRSIG1(DNSKEY)      RRSIG1(DNSKEY)     RRSIG1(DNSKEY)
      RRSIG10(DNSKEY)     RRSIG10(DNSKEY)    RRSIG11(DNSKEY)
      RRSIG11(DNSKEY)
      ----------------------------------------------------------------

                Double Signature Zone Signing Key Rollover

It should say:

   Double signature ZSK rollover involves three stages as follows:

      ----------------------------------------------------------------
      initial             new DNSKEY         DNSKEY removal
      ----------------------------------------------------------------
      SOA0                SOA1               SOA2
      RRSIG10(SOA0)       RRSIG10(SOA1)      RRSIG11(SOA2)
|                         RRSIG11(SOA1)

      DNSKEY1             DNSKEY1            DNSKEY1
      DNSKEY10            DNSKEY10           DNSKEY11
|                         DNSKEY11
      RRSIG1(DNSKEY)      RRSIG1(DNSKEY)     RRSIG1(DNSKEY)
      RRSIG10(DNSKEY)     RRSIG10(DNSKEY)    RRSIG11(DNSKEY)
      RRSIG11(DNSKEY)
      ----------------------------------------------------------------

                Double Signature Zone Signing Key Rollover

Rationale: The mis-alignment of the indicated 2 lines breaks the
intended presentation of the procedure; cf. subsequent RFC text.

(3)  typo: 'then' --> 'than'

On page 9, the 1st paragraph of Section 3.5 says:

   When choosing key sizes, zone administrators will need to take into
   account how long a key will be used, how much data will be signed
   during the key publication period (see Section 8.10 of [17]), and,
   optionally, how large the key size of the parent is.  As the chain of
   trust really is "a chain", there is not much sense in making one of
   the keys in the chain several times larger then the others.  [...]

It should say:

   When choosing key sizes, zone administrators will need to take into
   account how long a key will be used, how much data will be signed
   during the key publication period (see Section 8.10 of [17]), and,
   optionally, how large the key size of the parent is.  As the chain of
   trust really is "a chain", there is not much sense in making one of
|  the keys in the chain several times larger than the others.  [...]

(4) missing article

The 2nd paragraph on page 18, within Section 4.2.1.2, says:

   Making sure that the "new DNSKEY" phase lasts until the signature
   expiration time of the data in initial version of the zone is
   recommended.  [...]

It should say:

   Making sure that the "new DNSKEY" phase lasts until the signature
|  expiration time of the data in the initial version of the zone is
   recommended.  [...]

I strongly recommend to post an RFC Errata Note for RFC 4641,
at least covering itmes (1) and (2) above, to help avoid
 misunderstanding of the text by the former issues.

Best regards,
  Alfred Hönes.

-- 

+------------------------+--------------------------------------------+
| TR-Sys Alfred Hoenes   |  Alfred Hoenes   Dipl.-Math., Dipl.-Phys.  |
| Gerlinger Strasse 12   |  Phone: (+49)7156/9635-0, Fax: -18         |
| D-71254  Ditzingen     |  E-Mail:  [email-masked]                     |
+------------------------+--------------------------------------------+