Subject: [DNSOP] Discussions of NSEC5

From: "Paul Hoffman" <[email-masked]>
Date: Tue, 28 Mar 2017 13:28:58 -0500

During the mic discussions of NSEC5 yesterday, some speakers conflated a 
few things.

- NSEC3 with a good dictionary allows a fair amount of zone enumeration, 
but NSEC3 White Lies does not. Sharon did a good job of differentiating 
this in her slides, but people talking about the need for NSEC5 did not.

- White Lies can be done with NSEC, not just with NSEC3. RFC 7129 calls 
these "minimally covering NSEC records". I would think that doing NSEC 
White Lies would require less CPU than doing NSEC3 White Lies (but I 
haven't done the work to be sure).

When saying why one prefers NSEC5 over the current solutions, it is good 
to be specific which of the current solutions we are talking about.

--Paul Hoffman

---

From: Shumon Huque <[email-masked]>
Date: Tue, 28 Mar 2017 20:50:10 -0500

On Tue, Mar 28, 2017 at 1:28 PM, Paul Hoffman <[email-masked]> wrote:
[...]

> haven't done the work to be sure).

I would say that's almost definitely true, but I haven't done the empirical
work
either.

The reason Sharon's slides and the research paper only show performance
results
versus NSEC3 white lies is that was the only white lies implementation in a
production quality open-source nameserver available/known to us at the time
of the measurement work.

-- 
Shumon Huque