Subject: Re: I-D ACTION:draft-ietf-dnsext-ad-is-secure-03.txt

From: Randy Bush <[email-masked]>
Date: Tue, 24 Jul 2001 15:52:50 -0700

> I'm confused as to how "almost everyone" agrees with this.

most of us are silent unless we have something new to say.  but if you
want meeee tooooos.

randy, individual hat for sure

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Brian Wellington <[email-masked]>
Date: Tue, 24 Jul 2001 15:16:18 -0700

On Tue, 24 Jul 2001, Ted Lindgreen wrote:

> [Quoting Edward Lewis, on Jul 24, 20:33, in "Re: I-D ACTION:draft ..."]
>
> > Although I have been arguing for verify-on-send/reply, ...
>
> I totally agree with this, like probably almost everyone else on
> this list, certainly for the common case of all reasonably sized
> zones, which is > 99% of all zones. A special solution (an option
> to disable it) seems more logical to cope with the special case.

I'm confused as to how "almost everyone" agrees with this.  From what I
can tell, there are about 5 people participating in this discussion, and
only 3 are in favor of this.

verify-on-query is incredibly inefficient, even for small zones.
Authoritative DNS servers can easily answer thousands of queries per
second.  Modern computers can maybe do a few hundred signature
verifications per second.  Combined with other overhead, I'd be surprised
if a server doing verify-on-query was less than 10x times slower than an
ordinary server.  Would you want to run a server like that?  I wouldn't.

> I can understand that for a handful of superlarge zones like .com,
> BIND can run into a performance problem, but I don't understand
> why this must lead to not implement signature checking of local
> data at all into nameserver software meant for general use.

This is not a BIND issue.  It's a fundamental problem that DNSSEC
verification is slow, and the authoritative server should not be doing it.

> Or should we conclude from this that BIND-9, in contrast to all
> previous BIND implementations, is geared towards the special
> case of superlarge zones, and this special case only?

No.  BIND 9 is geared towards use.  verify-on-query has nothing to do with
the size of the zone.  It uniformly reduces performance by a significant
amount, for virtually no gain.

> Also, another proposal from Nominum (Roy Arends) to separate the
> functions from authorative servers and caching forwarders, which
> does not fit in many (most?) situations, like nameservers on company,
> university, etc. networks, seems to support the above conclusion.

The multiple-views idea fits perfectly well into any situation.  It's
still one server.  The only difference is that the authoritative part of
the server doesn't deal with verification.

Brian

---

From: Jakob Schlyter <[email-masked]>
Date: Wed, 25 Jul 2001 06:19:51 -0700

> ordinary server.  Would you want to run a server like that?  I wouldn't.

if you combine an acl for which clients to do verify-on-query for with
only doing verify-on-query when the client resolver indicates DNSSEC
support (using the EDNS0 DO bit), I do not think this would be a big
performance issue. it's also a lot easier than the multiple-view magic.

	jakob