Subject: Re: DS and Opt-in - a proposal

From: [email-masked] (Ted Lindgreen)
Date: Sat, 12 Jan 2002 14:19:20 +0100

Reading back my last message about the growth of zonefiles, I
realize that I forgot that in vanilla RFC2535 the child-KEYs and
their parental SIG can be exported away from the parent's zonefile
when a child becomes secured. This leads to a decreasing zonefile
as the secured fraction increases.

Although it does not change much from the conclusion
I've, just for fun, fixed the list.

Remember: N = number of delegations and large
          X = fraction secured
	  Delegation-only zonefile.

               Formula           few secured  half   most secured

No DNSSEC        3N               -            -      -
Vanilla        (5+(1-X)2)N        7N           6N     5N
DS             (5+2X)N            5N           6N     7N
OptIn+DS       (3+4X)N            3N           5N     7N

Anyway, I can't help being slightly amused to see people, who have
survived several orders of magnitude growth during the past Internet
hype, now being so exited about a mere variation around a factor
of 2 when it comes to implement DNSSEC :-)

-- ted

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: bert hubert <[email-masked]>
Date: Sat, 12 Jan 2002 15:25:27 +0100

> of 2 when it comes to implement DNSSEC :-)

Easy. Those orders of magnitude of growth in complexity were accompanied by
orders of magnitude of growth in revenue. In other words, they were needed
in order to increase business. Failure to meet the demand would lead to
decreased revenues or even disqualification as a registry.

Compare this to introducing OptIn-less DNSSEC.

Regards,

bert

-- 
http://www.PowerDNS.com          Versatile DNS Software & Services
http://www.tk                              the dot in .tk
Netherlabs BV / Rent-a-Nerd.nl           - Nerd Available -
Linux Advanced Routing & Traffic Control: http://ds9a.nl/lartc