Subject: UPDATE and NSEC3 parameter transitions.

From: Mark Andrews <[email-masked]>
Date: Mon, 28 Aug 2006 10:53:16 +1000

Some more NSEC3 questions.

        How do we, w/o updating config files, tell the primary master to
        start generating a new nsec3 chain with different parameters.

        How does the server signal that the chain is complete?

        How do we, w/o updating config files, tell the primary master to
        stop generation a nsec3 chain and potentially to start generating
        a NSEC chain?

-- 
ISC Training!  October 16-20, 2006, in the San Francisco Bay Area,
covering topics from DNS to DHCP.  Email [email-masked].
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE:	+61 2 9871 4742		         INTERNET: [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Wouter Wijngaards <[email-masked]>
Date: Mon, 28 Aug 2006 10:20:01 +0200

Hi Mark,

I'm not an expert in UPDATE but I didn't really get it.

>         start generating a new nsec3 chain with different parameters.

Why does someone want to change the NSEC3 parameters via dynamic update?
If a hash collision happens, the server can decide to perform salt++.

>         How does the server signal that the chain is complete?

The NSEC3 record with the SOA-bit on appears in the zone?

>         stop generation a nsec3 chain and potentially to start generating

Since NSEC3 is perfect, users do not need to transition back. If they
really want, users can stop the primary master and resign the zone.

Best regards,
   Wouter