Subject: RE: DS and Opt-in - a proposal

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sun, 13 Jan 2002 10:24:49 -0800

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

------_=_NextPart_000_01C19C5F.95E2F5F0
Content-Type: text/plain;
	charset="iso-8859-1"

OK so we are talking about 2.02*S rather than 0.02*S ??

So I was wrong! The difference between opt-in and not is
TWO orders of magnitude...

Debating points asside. I do not believe that any other
group in the IETF would raise the bar to admitting a 
protocol modification to 'proove to us that there is
absolutely no other way possible'.

On any reasonable grounds we have demonstrated that the
cost difference is overwhelming. Do we really have to
continue to argue over whether the cost difference is
the choice between negligible (and scalable) cost for 
Opt-in versus increasing the capacity of DNS 10 fold,
or only 6 fold.

OPT-IN scales, 2535 does not.

		Phill

Phillip Hallam-Baker FBCS C.Eng.
Principal Scientist
VeriSign Inc.
[email-masked]
781 245 6996 x227

> -----Original Message-----
> From: Derek Atkins [mailto:[email-masked]]
> Sent: Saturday, January 12, 2002 10:37 PM
> To: Hallam-Baker, Phillip
> Cc: Roy Arends; Ted Lindgreen; namedroppers
> Subject: Re: DS and Opt-in - a proposal
> 
> 
> No, I understand the point.  I was arguing that just because
> you need to support the maxima of (1+X)*2*S does not mean
> that you should expect to have two sets of SIGs at all times.
> Considering that the current assumption is that X=.01 at
> this time, we're talking about 2.02*S.
> 
> -derek
> 
> "Hallam-Baker, Phillip" <[email-masked]> writes:
> 
> > Derek is missing the point here, the NOC has to have capacity
> > for the peak load. The fact that key rollover is infrequent is 
> > irrelevant since you still have to plan capacity so you have
> > that capability.
> > 
> > 
> > Phillip Hallam-Baker FBCS C.Eng.
> > Principal Scientist
> > VeriSign Inc.
> > [email-masked]
> > 781 245 6996 x227
> > 
> > 
> > > -----Original Message-----
> > > From: Derek Atkins [mailto:[email-masked]]
> > > Sent: Saturday, January 12, 2002 3:59 PM
> > > To: Roy Arends
> > > Cc: Ted Lindgreen; namedroppers
> > > Subject: Re: DS and Opt-in - a proposal
> > > 
> > > 
> > > Roy Arends <[email-masked]> writes:
> > > 
> > > > I was assuming that one will sign a zone with more then one 
> > > key, which
> > > > will create more then one signature. If I want to do a 
> scheduled key
> > > > rollover, then at some point before the rollover date I 
> > > signed the zone
> > > > with 2 keys, and after the rollover with 2 keys, while the 
> > > two signing
> > > > events share at least one key. To smoothen the rollover, 
> > > I'll sign with 3
> > > > keys.
> > > 
> > > Ok, so the steady state of DS is (1+X)*S, with local maxima of
> > > (1+X)*2*S during (infrequent) times of key rollover.
> > > 
> > > > Example:
> > > > 
> > > > at point 1, there are 2 keys, key A and B. Now, I want to 
> > > roll key A over
> > > > to key C.
> > > 
> > > Why would you have two keys at any particular steady-state time?
> > > Sure, you need a second key during a rollover, but that 
> does not mean
> > > you need to keep around a second set of signatures at all times.
> > > 
> > > -derek
> > > -- 
> > >        Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
> > >        Member, MIT Student Information Processing Board  (SIPB)
> > >        URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
> > >        [email-masked]                        PGP key available
> > > 
> > > 
> > > to unsubscribe send a message to 
> > > [email-masked] with
> > > the word 'unsubscribe' in a single line as the message text body.
> > > 
> > 
> > 
> 
> -- 
>        Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
>        Member, MIT Student Information Processing Board  (SIPB)
>        URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
>        [email-masked]                        PGP key available
> 
> 
> to unsubscribe send a message to 
> [email-masked] with
> the word 'unsubscribe' in a single line as the message text body.
> 

------_=_NextPart_000_01C19C5F.95E2F5F0
Content-Type: application/octet-stream;
	name="Phillip Hallam-Baker (E-mail).vcf"
Content-Disposition: attachment;
	filename="Phillip Hallam-Baker (E-mail).vcf"

BEGIN:VCARD
VERSION:2.1
N:Hallam-Baker;Phillip
FN:Phillip Hallam-Baker (E-mail)
ORG:VeriSign
TITLE:Principal Consultant
TEL;WORK;VOICE:(781) 245-6996 x227
EMAIL;PREF;INTERNET:[email-masked]
REV:20010214T163732Z
END:VCARD

------_=_NextPart_000_01C19C5F.95E2F5F0--

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Derek Atkins <[email-masked]>
Date: 13 Jan 2002 13:38:07 -0500

> TWO orders of magnitude...

What are you smoking, Phill?  Whatever it is, can you get me some?

How does a multiplier of 2 result in two orders of magnitude?  Also,
as has been said, with DS you don't get the 2.02*S, because you never
need to have two complete sets of signatures.  You only need two sets
of KEY records with associated DS to the parents, but you never need
to completely sign your zone with two keys to perform a key rollover.

So, it really is 1.01*S.  And that's the _additional_ data, not the
ratio.  We'd still need the zone-size and number-of-children zones
in .COM to accurately determine this size increase.

> Opt-in versus increasing the capacity of DNS 10 fold,

Is a factor of 4-6 really overwhelming?

> OPT-IN scales, 2535 does not.

Who's talking 2535 Phill (well, except you)?  Everyone else is
assuming DS, except of course Verisign.  Maybe because you feel DS
makes Opt-in unimportant for pretty much anyone else and therefore
oblitertes most of your arguments?

-derek

PS: At this point in time I believe this WG has hit a roadblock.
I do not believe we can come to concensus on the importance of
Opt-In. Perhaps the chairs can ask the ADs/IESG for guidance?

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Sun, 13 Jan 2002 02:59:13 -0800

> absolutely no other way possible'.

You missed the months long dance in provreg over whether registries could
initiate instances of communication, or if notice of pending state update
(registrar initiated inst-o-com) distribution was better, for some value
of "better".

I could mention IDN and the recent reordering and conversion issues, both
being "intermediate mapping (tables) between subsets of iso10646" attempts
contrary to the holy write of Unicode, and impossible to advance even when
the "absolutely no other way possible" test has been met, but that would be
a distraction into a real swamp.

My point being that I don't share the perception that this WG is unreasonable.

Eric