Subject: Requirments Question

From: Ben Laurie <[email-masked]>
Date: Wed, 06 Oct 2004 11:16:45 +0100

As has been requested, I am constructing a matrix of compatibility 
between requirements in the requirements I-D.

Whilst doing so, I realise I don't understand one of them:

23.  Coexistence with NSEC

    NSEC++ should be designed to coexist with NSEC.

    Contributor: Ed Lewis

What is this supposed to mean in practice?

Cheers,

Ben.

-- 
ApacheCon! 13-17 November! http://www.apachecon.com/

http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Wed, 06 Oct 2004 19:29:28 +0000

> What is this supposed to mean in practice?

see <http://ops.ietf.org/lists/namedroppers/namedroppers.2004/msg00967.html>.

---

From: Edward Lewis <[email-masked]>
Date: Wed, 6 Oct 2004 15:47:57 -0400

>What is this supposed to mean in practice?

E.g., number registries won't get any benefit from NSEC++ beyond what 
NSEC offers.  Therefore, if NSEC++ means more work than NSEC, then 
NSEC++ is a net loss to the number registries.  Ergo - the number 
registries would be better off with NSEC - so it's important that 
NSEC and NSEC++ coexist.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

"I can't go to Miami.  I'm expecting calls from telemarketers." -
Grandpa Simpson.

---

From: Ben Laurie <[email-masked]>
Date: Thu, 07 Oct 2004 12:56:09 +0100

Edward Lewis wrote:
> registries would be better off with NSEC - so it's important that NSEC 
> and NSEC++ coexist.

Then this is actually the same as:

24.  Coexistence with NSEC II

    NSEC++ should be optional, allowing NSEC to be used instead.

yes?

Cheers,

Ben.

---

From: Alex Bligh <[email-masked]>
Date: Thu, 07 Oct 2004 14:36:45 +0100

--On 06 October 2004 15:47 -0400 Edward Lewis <[email-masked]> wrote:

> so it's important that NSEC and NSEC++ coexist.

IE that servers should be permitted to use either scheme, and resolvers
which are NSEC++ compatible should also support NSEC.

Alex

---

From: "Olaf M. Kolkman" <[email-masked]>
Date: Thu, 07 Oct 2004 22:02:51 +0200

> which are NSEC++ compatible should also support NSEC.

to be even more verbose...

And a server that only support NSEC should tread NSEC++ as "non-secured 
data" and not choke. Besides it should
be possible to go from a NSEC signed parent (the root that has no zone 
enumerations problems) to a NSEC++ child for
both a NSEC only and an NSEC and NSEC++ aware validating resolver.

The NSEC only aware resolver should see this as "leaving" the secure 
island (the child being verifyably unsecure).

While for the NSEC + '++' resolver you'd go from one secure zone to another.

There is no requirement (except if there is a requirement to migrate 
from one scheme to another without being "unsecure") to
have both NSEC and NSEC++ in the same zone.

(Where I read "NSEC++" as a mechanism to precompute and sign 
non-existence statements,  possibly hashed based :-) )

--Olaf
  namedropper.