Subject: Re: DS and Opt-in - a proposal

From: [email-masked] (Ted Lindgreen)
Date: Sat, 12 Jan 2002 21:43:57 +0100

[Quoting Roy Arends, on Jan 12, 20:37, in "Re: DS and Opt-in -  ..."]

> All that, still 71 hrs of sorting & signing, for a zone that denies
> security for every individual delegation.

Please, lets stick to the subject, we were talking about the size of
a zonefile, not the CPU time of the signing session. And IF you want
to discus CPU time, then don't use the elapsed-time it took us to
sign .com on a memory starved alpha desktop PC as reference.

[Quoting Derek Atkins, on Jan 12, 21:11, in "Re: DS and Opt-in -  ..."]
 
> Where do you get 3 Sigs per RRset?  There is SIG{NXT} for each record,
> sure.  And for the secure children there is SIG{DS}.  That's 1+X.
> Where is this third signature coming from?

No, the two SIGs were not for different RRsets, Roy assumed we will
be using 3 SIGs per RRset, each from different KEYs. There are a few
RFC drafts talking about more than one KEY and/or SIG to allow for
key rollovers, but I'm not sure why Roy thinks that 3 KEY/SIG sets
for all RRsets in a TLD will be the future norm. Roy, perhaps you
can enlighten us?

-- ted

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Derek Atkins <[email-masked]>
Date: 12 Jan 2002 16:07:51 -0500

> be using 3 SIGs per RRset, each from different KEYs. There are a few

Except in delegation zones like .COM the only entries are NS and
glue-A records, neither of which are actually signed.  So you're not
actually signing each RRSet, you're signing each node (regarless of
the number of RRSets at that node).

It doesn't matter how many NS or glue-A records you have; you're only
signing SIG{NXT} and SIG{DS} at the NS nodes and ignoring the glue-A
nodes.

> for all RRsets in a TLD will be the future norm. Roy, perhaps you

I don't understand this, either.  Sure, you need a second key (which
doubles the number of signatures) during key rollover, but I don't
expect anyone to keep multiple key/sigs around at all times.

> -- ted

-derek

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
       [email-masked]                        PGP key available