Subject: RE: DS and Opt-in - a proposal

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sat, 12 Jan 2002 19:05:35 -0800

Derek is missing the point here, the NOC has to have capacity
for the peak load. The fact that key rollover is infrequent is 
irrelevant since you still have to plan capacity so you have
that capability.

Phillip Hallam-Baker FBCS C.Eng.
Principal Scientist
VeriSign Inc.
[email-masked]
781 245 6996 x227

> -----Original Message-----
> From: Derek Atkins [mailto:[email-masked]]
> Sent: Saturday, January 12, 2002 3:59 PM
> To: Roy Arends
> Cc: Ted Lindgreen; namedroppers
> Subject: Re: DS and Opt-in - a proposal
> 
> 
> Roy Arends <[email-masked]> writes:
> 
> > I was assuming that one will sign a zone with more then one 
> key, which
> > will create more then one signature. If I want to do a scheduled key
> > rollover, then at some point before the rollover date I 
> signed the zone
> > with 2 keys, and after the rollover with 2 keys, while the 
> two signing
> > events share at least one key. To smoothen the rollover, 
> I'll sign with 3
> > keys.
> 
> Ok, so the steady state of DS is (1+X)*S, with local maxima of
> (1+X)*2*S during (infrequent) times of key rollover.
> 
> > Example:
> > 
> > at point 1, there are 2 keys, key A and B. Now, I want to 
> roll key A over
> > to key C.
> 
> Why would you have two keys at any particular steady-state time?
> Sure, you need a second key during a rollover, but that does not mean
> you need to keep around a second set of signatures at all times.
> 
> -derek
> -- 
>        Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
>        Member, MIT Student Information Processing Board  (SIPB)
>        URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
>        [email-masked]                        PGP key available
> 
> 
> to unsubscribe send a message to 
> [email-masked] with
> the word 'unsubscribe' in a single line as the message text body.

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Derek Atkins <[email-masked]>
Date: 12 Jan 2002 22:37:02 -0500

No, I understand the point.  I was arguing that just because
you need to support the maxima of (1+X)*2*S does not mean
that you should expect to have two sets of SIGs at all times.
Considering that the current assumption is that X=.01 at
this time, we're talking about 2.02*S.

-derek