Subject: Re: nsec2 large label pain

From: Simon Josefsson <[email-masked]>
Date: Mon, 24 May 2004 15:05:26 +0200

[email-masked] writes:

> I'd like to address an issue due to large labels in NSEC2.
>
> SHA1 output is 160 bits. Represented in hexadecimal thats 40 bytes for the
> owner name and the next domain name as well. The signature of the NSEC2
> has the same owner name. Thats 120 Bytes extra per NSEC2 compared to nsec
> (minus 3 times the original label length). This has negative implications
> for packet-size, zone-size and truncation. I'd like to see that reflected
> in the draft.

Can't you use standard DNS name compression techniques on the SIG
owner name?  If so, it is more like 80 bytes, minus the original label
length, extra.  If this size increase is a major obstacle for people,
it may be possible to explore hash truncation.

Regards,
Simon

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Marcos Sanz/Denic <[email-masked]>
Date: Mon, 24 May 2004 15:23:58 +0200

> it may be possible to explore hash truncation.

Rather to explore an alternative representation to hexadecimal?

Regards,
Marcos

---

From: [email-masked]
Date: Mon, 24 May 2004 16:09:36 +0200 (CEST)

On Mon, 24 May 2004, Simon Josefsson wrote:

> owner name?

Absolutely. You can.

> If so, it is more like 80 bytes, minus the original label
> length, extra.

<nit> plus the compression-pointer.

> If this size increase is a major obstacle for people,

There are several ways to 'fix this', including a new label type (type
HASH or something evil) if you like.

There are other obstacles as well. Current label length restricts the
message digest size (if represented in hex) to 248 bits. This excludes
functions like sha-256/384/512.

Roy

---

From: Ben Laurie <[email-masked]>
Date: Mon, 24 May 2004 16:43:47 +0100

> for packet-size, zone-size and truncation. I'd like to see that reflected

I did put a note about it. Do you have a particular suggestion for what 
we should say where? Or shall I invent some words myself?

Can we do base 64 to reduce size? I realise this (theoretically at 
least) introduces character set issues. If we respect those, can we do 
base 37 - this reduces 160 bits to 31 bytes (i.e. an overhead of 93 
bytes minus three times the original label length)? Is that worth the 
ugliness?

Incidentally, someone said yesterday that the average label length in 
some TLD (.com?) was 15 characters, IIRC, so this would give an average 
overhead of 48 bytes. Given that DNSSEC (according to Olaf) introduces a 
350 byte overhead already, that doesn't sound _too_ bad to me.

Cheers,

Ben.