Subject: RE: Pimping DNSSEC (was Re: DNSSEC - Signature Only vs the MX/A issue.)

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 5 Dec 2006 07:43:41 -0800

> From: Alex Bligh [mailto:[email-masked]] 

> I'm not sure whether this is the same point Phil is making, 
> but inc ase not, it seems to me the RoI argument is like 
> expecting positive RoI on the deployment of the first 
> telephone. 

Part of it.

There is a chicken and egg problem in every one of these network effect marketting type schemes. So to create critical mass you need to have a strategy that does not depend on the network effect.

DKIM has a unilateral deployment advantage albeit a weak one. DKIM + Secure Letterhead has a much stronger deployment advantage.

The point here is to design for deployment and in particular to work to co-opt the participation of major infrastructure providers, major platform providers.

Absolutely nobody has made the claim that NSEC3 is too complex to be deployed. Multiple registries have stated that they cannot deploy without NSEC3. This is the only group I know where this would still be under discussion.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: bert hubert <[email-masked]>
Date: Tue, 5 Dec 2006 18:05:40 +0100

On Tue, Dec 05, 2006 at 07:43:41AM -0800, Hallam-Baker, Phillip wrote:

> Absolutely nobody has made the claim that NSEC3 is too complex to be
> deployed. 

Let me then make the claim that DNSSEC-bis + NSEC3 is so complex I have
serious worries over its reliable implementability, especially considering
the number of corner cases.

	Bert
-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://netherlabs.nl              Open and Closed source services