Subject: NSEC3 Issue 19, revisited.

From: David Blacka <[email-masked]>
Date: Thu, 24 Aug 2006 14:38:23 -0400

Again, in preparation for the next version of the NSEC3 draft, the
editors are revisiting some of the open issues.

This issue is stated as follows:

> Issue: Should the document specify a recommendation about if a validating
> resolver should process first
>     the range of NSEC3 names covers query name
> or    the signature on the NSEC3 records is valid
> 
> Discussion:  RFC4035 specifies/recommends that validating resolver first
> check that the name range applies before validating the signature, as that
> is the less expensive operation. For a NSEC3 with high iteration count it
> is possible that validating the signature is less expensive than checking
> the name range.

As far as I can tell, RFC 4035 actually doesn't say this.

As such, I personally feel that the NSEC3 draft should be equally silent
about this.  Opinions?

-- 
David Blacka                      <[email-masked]>
Sr. Engineer    VeriSign Infrastructure Product Engineering

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Mark Andrews <[email-masked]>
Date: Fri, 25 Aug 2006 10:09:51 +1000

> As such, I personally feel that the NSEC3 draft should be equally silent

	Data point.  Named checks the signature first for both nsec and
	nsec3.
 
--
ISC Training!  October 16-20, 2006, in the San Francisco Bay Area,
covering topics from DNS to DHCP.  Email [email-masked].
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Wouter Wijngaards <[email-masked]>
Date: Fri, 25 Aug 2006 17:18:50 +0200

> 	Data point.  Named checks the signature first for both nsec and

The cost of nsec3 is easily scalable, the signature verification is not
so easy. You could also first check if the nsec3 is really from the same
zone. I am in favor of leaving it out of the draft.

Best regards,
   Wouter

---

From: Wes Hardaker <[email-masked]>
Date: Fri, 25 Aug 2006 09:41:20 -0700

>>>>> "DB" == David Blacka <[email-masked]> writes:

DB> As such, I personally feel that the NSEC3 draft should be equally silent
DB> about this.  Opinions?

I think providing implementation guidance is a good thing.  It
documents what the protocol authors were thinking about weighing
trade-offs.  It (obviously I hope) shouldn't use CAPS in the text
though since it's not interoperability related.
-- 
Wes Hardaker
Sparta, Inc.