Today DNSSEC03 assumes that there is a minimum key size for a given zone. However a zone could have a NSEC3PARAM RR but no valid DNSKEY RR. In this case we are instructed to take the minimum value of an empty set, which is an impossible operation. DNSSEC03 should specify how to deal with this situation.

(DNSSEC03 could benefit from some love in general too. E.g. there are links that don't work, questionable grammar, unclear control flow structure, references to severity levels in the procedure section, explanations of semantics in the procedure section, etc. Maybe these things are meant to be fixed when updating DNSSEC03 with "Detailed steps", but I'm not sure so I wanted to mention them somewhere.)