Subject: Re: More on NSEC2 label size and DoS

From: [email-masked]
Date: Wed, 26 May 2004 12:22:10 +0200 (CEST)

On Wed, 26 May 2004, Jim Reid wrote:

> >>>>> "roy" == roy  <[email-masked]> writes:
>
>     roy> btw, if hashes are per owner name instead of per label, then
>     roy> other size issues are at hand, since for every intermediate
>     roy> label level (empty non terminal) a new NSEC+SIG (or EXIST)
>     roy> needs to be created.
>
>     roy> That hurts in zones under ip6.arpa and e164.arpa.
>
> Something similar to NSEC2 would be pointless for e164.arpa because
> the name space is regular and well-known: eg all North American E.164
> numbers are exactly 10 digits long after the +1. Enumeration of this
> name space using DNS lookups is a no-brainer irrespective of how or if
> the zones get signed.

True, but irrelevant. If NSEC2 is adopted, deprecating NSEC, it does not
discriminate between reverse and forward zones. If ip6.arpa is signed, it
is signed with NSEC2. No choice, no way out.

Roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: [email-masked]
Date: Wed, 26 May 2004 19:33:57 +0200 (CEST)

On Wed, 26 May 2004, Ben Laurie wrote:

> [email-masked] wrote:
> My intention (I cannot speak for the WG, of course) was to make it
> possible to choose NSEC or NSEC2, since if you don't mind zonewalking,
> you shouldn't have to incur the overhead of NSEC2.

ack