Subject: Re: NSEC3 Issue 19, revisited.

From: Mark Andrews <[email-masked]>
Date: Fri, 25 Aug 2006 10:09:51 +1000

> Again, in preparation for the next version of the NSEC3 draft, the
> editors are revisiting some of the open issues.
> 
> This issue is stated as follows:
> 
> > Issue: Should the document specify a recommendation about if a validating
> > resolver should process first
> >     the range of NSEC3 names covers query name
> > or    the signature on the NSEC3 records is valid
> > 
> > Discussion:  RFC4035 specifies/recommends that validating resolver first
> > check that the name range applies before validating the signature, as that
> > is the less expensive operation. For a NSEC3 with high iteration count it
> > is possible that validating the signature is less expensive than checking
> > the name range.
> 
> As far as I can tell, RFC 4035 actually doesn't say this.
> 
> As such, I personally feel that the NSEC3 draft should be equally silent
> about this.  Opinions?

	Data point.  Named checks the signature first for both nsec and
	nsec3.
 
> -- 
> David Blacka                      <[email-masked]>
> Sr. Engineer    VeriSign Infrastructure Product Engineering
> 
> --
> to unsubscribe send a message to [email-masked] with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/namedroppers/>
--
ISC Training!  October 16-20, 2006, in the San Francisco Bay Area,
covering topics from DNS to DHCP.  Email [email-masked].
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Wes Hardaker <[email-masked]>
Date: Fri, 25 Aug 2006 09:41:20 -0700

>>>>> "DB" == David Blacka <[email-masked]> writes:

DB> As such, I personally feel that the NSEC3 draft should be equally silent
DB> about this.  Opinions?

I think providing implementation guidance is a good thing.  It
documents what the protocol authors were thinking about weighing
trade-offs.  It (obviously I hope) shouldn't use CAPS in the text
though since it's not interoperability related.
-- 
Wes Hardaker
Sparta, Inc.