Subject: Re: On dynamic NSEC

From: Roy Arends <[email-masked]>
Date: Thu, 11 Nov 2004 16:42:47 +0100 (CET)

On Fri, 12 Nov 2004, Mark Andrews wrote:

>
> > > > I raised this problem, in the context of lying NSEC, during the
> > > > DNSECbis last call.  It was apparently ignored.
> > > >
> > > > http://article.gmane.org/gmane.ietf.dnsext/5339
> > > >
> > > > I maintain that the MUST cannot in general be verified by clients, and
> > > > hence should not be part of the specification.  Further I believe that
> > > > the text prevent deployment of NSEC alternatives.
> > >
> > > This is a known issue. In order to deploy NSEC+epsilon, we have to
> > > change the text.
> >
> > IMHO, this is a non-issue. It is a NSEC+epsilon is a temporary transistion
> > path until DNSSEC-ter.
>
> 	Maybe temporary.  Once implemented there is less pressure
> 	to implement other online signing solutions.

Yes. So we can focus on nsec++. Online signing is not really optimal for
high load servers.

>       To get rid
> 	of enumeneration in deep zones online signing appears to
> 	be the only solution.

Not really. This can be solved using CNAME for these extremely long names.
If you're referring to wildcards, I see the problem. Wildcard proofs using
NSEC++ may have multiple NSEC++'s in contrast with current NSEC where
there is a maximum of two.

> 	Once there is a online signing solution it is unlikely that
> 	a second solution will be implemented.

No worries. Online signing is not an optimal solution. NSEC++ is not an
optimal solution as well. We might need both.

I do think that the larger TLD's might have a problem with dynamic
signing, due to several critical deployment issues, like an online key,
high response cost due to the crypto, key management between the
authoritative servers.

Typically, these larger TLD's do not have zones with very long, multiple
labels. In general TLD's have just single label deep delegations, so the
wildcard problem of > 2 NSEC++ does not apply.

Roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Ben Laurie <[email-masked]>
Date: Thu, 11 Nov 2004 15:32:23 +0000

Mark Andrews wrote:
> 	to implement other online signing solutions.  To get rid

As I pointed out yesterday, deep zones are only an issue with hashed 
NSEC if you consider the hashes to be names. Clearly this is the 
simplest solution, but, equally clearly, it is not the only one.

> 	a second solution will be implemented.

Given that there are several TLDs (and probably others) that won't 
deploy online keys, nor NSEC, I think you're wrong. But there's little 
point debating it. It'll either happen, or it won't.

Cheers,

Ben.