Subject: NSEC3 Issue 19, revisited.

From: David Blacka <[email-masked]>
Date: Thu, 24 Aug 2006 14:38:23 -0400

Again, in preparation for the next version of the NSEC3 draft, the
editors are revisiting some of the open issues.

This issue is stated as follows:

> Issue: Should the document specify a recommendation about if a validating
> resolver should process first
>     the range of NSEC3 names covers query name
> or    the signature on the NSEC3 records is valid
> 
> Discussion:  RFC4035 specifies/recommends that validating resolver first
> check that the name range applies before validating the signature, as that
> is the less expensive operation. For a NSEC3 with high iteration count it
> is possible that validating the signature is less expensive than checking
> the name range.

As far as I can tell, RFC 4035 actually doesn't say this.

As such, I personally feel that the NSEC3 draft should be equally silent
about this.  Opinions?

-- 
David Blacka                      <[email-masked]>
Sr. Engineer    VeriSign Infrastructure Product Engineering

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Wouter Wijngaards <[email-masked]>
Date: Fri, 25 Aug 2006 17:18:50 +0200

Mark Andrews wrote:
> 	Data point.  Named checks the signature first for both nsec and
> 	nsec3.
>  

The cost of nsec3 is easily scalable, the signature verification is not
so easy. You could also first check if the nsec3 is really from the same
zone. I am in favor of leaving it out of the draft.

Best regards,
   Wouter