Subject: NSEC3 Issue 15: recommend against the use of partially opt-out zones.

From: Roy Arends <[email-masked]>
Date: Wed, 31 May 2006 12:21:16 +0200

Issue:

A single zone may contain NSEC3 records with the optout bit set or clear. 
To cope with the granularity of a per-record signal of opt-out introduces 
additional complexity for signing and dynamically updating such a zone 
while the use case for this granularity is not clear.

Discussion:

To cope with partially opt-out zone, a signer needs to know if an unsigned 
delegation is supposed to be optout or not. With regards to dynamic 
update, the server needs to determine whether newly added unsigned 
delegations are supposed to be optout or not.

If the granularity is per zone, a signer can be signalled by a single 
command-line option, or by some meta data. When such a zone is dynamically 
updated, the server can determine if the added unsigned delegation is 
supposed to be optout or not by looking at the nsec3 at the SOA.

Resolution:

We haven't found a practical case where partially optout zones are 
preferred over fully opt-out zones. We therefor propose to add text to the 
draft that discourages, but not ban, the use of partially opt-out zones.

Regards,

Roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>