Subject: Re: chairs' message on opt-in

From: Paul Vixie <[email-masked]>
Date: Mon, 05 May 2003 18:45:04 +0000

> > If it is declared experimental, will there be a mechanism to alert a
> > resolver that the zone uses OPT-IN?

an experimental rfc will still reserve the encoding (NXT bit not set in
NXT bitmask) and this condition would be enough to signal opt-in to those
validators who understood it.  it would be treated as either a format error
or a no-op by those validators who did not understand it.  in no case does
the zone need to alert anybody of its intentions.

> Well, the resolver can flag through edns its compliance with opt-in.

that would be expensive, since the NXT mask would then have to be signed
both with and without the "NXT bit is zero in the NXT bitmask" condition.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Mon, 05 May 2003 18:39:01 +0000

roy, among other things, you wrote:

> It took 3 years before moore's law projected on todays hw with 3 yr old
> stats would become valid.
> 
> Applying Moore's law is valid when applied to all variables, including
> data size, not just the ones that fits the argument.
> 
> Today's DNSSEC just doesn't scale.
> 
> [1] The Eight Fallacies of Distributed Computing.
>     http://java.sun.com/people/jag/fallacies.html

i have two observations.

1. you're not going to convince anybody to change their mind about opt-in
using this approach, or indeed any other approach.  the debate is polarized
and no minds will change now.

2. dnssec can be made to scale.  its nondeployability due to lack of opt-in
is an L9 issue not an L1 issue.  (a compelling L9 issue, to be sure, but
the point is, this isn't a hardware problem.)

paul