Subject: NSECX proposals

From: Jelte Jansen <[email-masked]>
Date: Mon, 02 Aug 2004 22:12:22 +0000

Hi,

do the drafts describing possible NSEC replacements or the 
requirements/transitions documents say anything about how much (or maybe 
just if) these proposals add to the complexity of maintaining zones (for 
example does it make it harder to change anything, or is incremental 
signing still possible)? If DNSSEC acceptance is an argument for 
proposing other NSEC schemes, i think that maintainability is a huge factor.

Jelte

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Samuel Weiler <[email-masked]>
Date: Tue, 3 Aug 2004 13:29:37 -0400 (EDT)

> requirements/transitions documents say anything about how much (or
> maybe just if) these proposals add to the complexity of maintaining
> zones (for example does it make it harder to change anything, or is
> incremental signing still possible)?

Without commenting on what the drafts presently say (esp. since
they're likely to be revised soon), and with the caveat that the doc
editors know their docs better than I...

The NSEC2/3 proposals do NOT appear to add complexity.  Incremental
signing is still possible.  Adding names is just as easy[1,2].
Deleting names is just as easy[2].  They could add computational load
(esp. with multiple hash iterations, as NSEC2 proposes), but no
particular complexity.

-- Sam

[1]  Unless you find a hash collision.  There are signifigant
differences of opinion about whether we need to worry about hash
collisions at all.

[2]  Except that, with NSEC2, you need to check for the creation of
empty non-terminals and create EXIST RRs at those names.  This
doesn't seem very painful.

---

From: Ben Laurie <[email-masked]>
Date: Tue, 03 Aug 2004 19:49:29 +0100

> proposing other NSEC schemes, i think that maintainability is a huge 

Changing the salt will cause you to have to resign all NSEC++ records, 
but other than that, zone maintenance is roughly the same as NSEC.

Cheers,

Ben.