Subject: NSEC3 Issue 9, update

From: David Blacka <[email-masked]>
Date: Fri, 25 Aug 2006 17:43:17 -0400

NSEC3 Issue 9 (potential denial of service against resolvers) has mostly
be addressed.  The one outstanding thing to be addressed in the next
version of the draft was to change the values in the table in section
9.2 to values based on verifications.  The idea is that calculating a
hash should be in the same order-of-magnitude as other crypto operations
that happen during validation.

So, the existing table for RSA is:

Key Size     Iterations
--------     ----------
1024              3,000
2048             20,000
4096            150,000

Based on my testing, switching this to RSA validations gets you this
(all numbers rounded to nice even numbers):

Key Size     Iterations
--------     ----------
1024                150
2048                500
4096              2,500

based on roughly: 150,000 sha-1s per second, 1000 1024-bit RSA
verifications per second, 300 2048-bit RSA verifications per second, and
 60 4096 verifications per second.

I did all this in Java on my trusty Powerbook G4.  It is likely that
different hardware and different crypto software will produce different
numbers.  But they should be roughly in the right ballpark.

I did not recalculate the DSA numbers, but verification speed for DSA is
actually slower than signing (at least for me), so the existing numbers
should be OK.

Opinions?

-- 
David Blacka                      <[email-masked]>
Sr. Engineer    VeriSign Infrastructure Product Engineering

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Ben Laurie <[email-masked]>
Date: Sat, 26 Aug 2006 00:05:46 +0100

> So, the existing table for RSA is:

Java is clearly teh suck, since I get about 5 times these speeds with
OpenSSL on my workstation, but the ratios are about right.

-- 
http://www.apache-ssl.org/ben.html           http://www.links.org/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

---

From: David Blacka <[email-masked]>
Date: Fri, 25 Aug 2006 20:04:55 -0400

> OpenSSL on my workstation, but the ratios are about right.

Actually, I was surprised at how close my numbers were to the  
original calculations.  Since you did the original ones, what were  
you using for them?

Interesting, the 1024-bit RSA verify rate is about twice as fast (by  
ratio between the rates) as it would be if it followed the same  
pattern as the signing rates.  If that makes any sense.

--
David Blacka    <[email-masked]>
Sr. Engineer    VeriSign Applied Research

---

From: Ben Laurie <[email-masked]>
Date: Sat, 26 Aug 2006 10:41:33 +0100

David Blacka wrote:
> Actually, I was surprised at how close my numbers were to the original
> calculations.  Since you did the original ones, what were you using for
> them?

A very crappy old machine :-)

> ratio between the rates) as it would be if it followed the same pattern
> as the signing rates.  If that makes any sense.

Yes.