DNSSEC Lookaside Validation (DLV) IANA Registry
draft-weiler-dnssec-dlv-iana-00

IANA Last Call Comments:

1) DNSSEC.ARPA does not exist. Creation of this domain would be a pre-requisite and must be done under the direction of the IAB according to RFC 3172. If there is to be be a single "authoritative" DLV registry for the entire Internet, IANA feels it is appropriate for this zone to be created in the "Addressing Parameters and Routing Area" infrastructure domain for various reasons, however the decision to create that domain is not in IANA's purview.

2) IANA's processes by which we authenticate requests to insert, modify, and delete root zone data from zone operators relies, at least in part, on the ability of IANA and others to visually inspect the data of the requests to verify they make sense. It is not clear these authentication mechanisms are appropriate or sufficient for dealing with DLV information if the intent is to have a strongly secured system.

3) Contrary to the vast majority of existing IANA registries, the DLV registry would be operational and mistakes or other failures could have instant significant and potentially lasting (for the DNS TTL, at least) operational impact. As such, the operational requirements of this registry should be specified to allow the determination of the cost of providing this registry.

4) In keeping with historical tradition, lacking any explicit mention of a mechanism by which the DLV registry would be closed down, IANA assumes the registry is permanent. It would be helpful if this were to be made explicit. If the DLV registry is not intended to be permanent, its closing conditions should be documented. Note that "upon signing of the root zone" is likely to be an insufficient closing condition as the the DLV registry is operational and uptake of the root zone trust anchor will likely not be instantaneous.

5) It seems odd the creation of a registry that can have the impact the DLV registry can have is not being done as the product of an IETF working group.

[Note]: 'The ballot has been split.  All previously entered DISCUSS and COMMENT text is associated with the ballot for draft-weiler-dnssec-dlv.  Please move appropriate text to the ballot for this document.' added by Russ Housley

IANA Evaluation Comments:

IANA has the following questions for this document:

- who does the IETF anticipate signing the DLV
  registry keys?
- what level of physical security does the IETF
  expect IANA to provide in administering the keys?
- what processes should IANA undertake in the event
  of a DLV registry key compromise?
- what pricing models/price caps do IETF consider
  reasonable/appropriate should ICANN need to
  recover the costs of providing this registry?