Subject: comments on draft-arends-dnsnr-00

From: "Loomis, Rip" <[email-masked]>
Date: Mon, 12 Jul 2004 22:41:06 -0400

Hello Roy--
In section 2.1.3, there is a sentence that says, "The Salt field
value must be the same for every DNSNR generated in the zone."
That may be a reasonable requirement, but off the top of my head
I think I can come up with some good reasons not to make that a
requirement--could you please elaborate (on list or in a revised
draft) as to why that's a "must"?

I also have some very very minor typos which I'll send to you
off-list.

  --Rip

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Roy Arends <[email-masked]>
Date: Tue, 13 Jul 2004 09:33:28 +0200 (CEST)

> draft) as to why that's a "must"?

I will add text to the draft on why that MUST be for every NSEC for the
same version.

In short, when a nameserver on reception of a query for a non-existent
name must add the proper DNSNR to the response (to repudiate existence),
it needs a salt (x) to augment QNAME, it will hash the result and find the
appropriate DNSNR to proof the hash(salt+qname) does not exist.

If (x) is different for every DNSNR, you might end up with proof claiming
example.com + salt=4 does not exist, and example.com + salt=7 does exist.

> I also have some very very minor typos which I'll send to you

Thanks !

Roy