Subject: Signing .de zone, different keysizes.

From: Roy Arends <[email-masked]>
Date: Thu, 27 Apr 2000 13:30:16 +0200 (CEST)

This was just sent to the DNSSEC-WG at CENTR.

---------- Forwarded message ----------
Date: Thu, 27 Apr 2000 13:28:25 +0200 (CEST)
From: Roy Arends <[email-masked]>
To: [email-masked]
Subject: [centr-dnssec-wg]Signing .de zone, different keysizes.

Hello,

Some more statistics on signing the .de zone. 
 
KEYsize  USR+SYS     (HMS)  TimeFactor Filesize          GrowthFactor

DSA-512  15493  ( 4h18m13s)  1         399275361 (380Mb) 3.24        
DSA-768  23712  ( 6h35m12s)  1.53      399275361 (380Mb) 3.24        
RSA-512  22645  ( 6h17m25s)  1.46      462208257 (440Mb) 3.76
RSA-768  53874  (14h57m54s)  3.48      544807683 (519Mb) 4.43
 
The labels:    
 
KEYsize     : The type and size of the key.
USR+SYS     : The USR+SYS time the signer process consumed in seconds.
(HMS)       : Usage and System time in Hours, Minutes, Seconds.
TimeFactor  : Time compared to a DSA-512 key Signing time.  
Filesize    : File size of the signed file. 
GrowthFactor: Filesize compared to the unsigned filesize (123068233).
 
The zone we've signed was converted to a delegation-only-zone (See
previous mail).

We used the signer that came with the distribution of BIND V9.0.0-b2. We
generated keys with the keygen tool, also from the distribution of BIND
V9.0.0-b2. The test-machine is an average off-the shelf pc with an athlon
500 MHz processor running FreeBSD 3.4 .

Regards,

Roy Arends

Never hit a man with glasses.  Hit him with a baseball bat.
-- 
[email-masked]                NLnetLabs
tel +31208884551                Kruislaan 419
|\ ||   _  _|_  |   _ |_  _     1098 VA  Amsterdam
| \||__| )(-|_  |__(_||_)_)     The Netherlands

---

From: Edward Lewis <[email-masked]>
Date: Thu, 27 Apr 2000 08:54:54 -0400

I'm replying only to dnsop only (as opposed to namedroppers).  There are a
lot of folks on both lists.

>RSA-512  22645  ( 6h17m25s)  1.46      462208257 (440Mb) 3.76

Not to take anything away from these numbers...RSA is known to be slower in
signing than DSA.  However, RSA is much, much faster in verification - last
I measured (in '96-'97), the difference was about 10.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                NAI Labs
Phone: +1 443-259-2352                      Email: [email-masked]

"It takes years of training to know when to do nothing" - Dogbert

Opinions expressed are property of my evil twin, not my employer.

---

From: Jerry Scharf <[email-masked]>
Date: Thu, 27 Apr 2000 07:49:18 -0700

Roy,

I think these numbers go a long way towards saying that the signing of large 
zones is doable. It also points up the need for a more sophisticated signing 
tool, one which can do incremenatal zone signing and can separate work over 
mulitple processors/computers.

jerry