Subject: [DNSOP] I-D Action: draft-ietf-dnsop-nsec3-guidance-00.txt

From: [email-masked]
Date: Tue, 25 May 2021 15:00:41 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Domain Name System Operations WG of the IETF.

        Title           : Guidance for NSEC3 parameter settings
        Authors         : Wes Hardaker
                          Viktor Dukhovni
	Filename        : draft-ietf-dnsop-nsec3-guidance-00.txt
	Pages           : 7
	Date            : 2021-05-25

Abstract:
   NSEC3 is a DNSSEC mechanism providing proof of non-existence by
   promising there are no names that exist between two domainnames
   within a zone.  Unlike its counterpart NSEC, NSEC3 avoids directly
   disclosing the bounding domainname pairs.  This document provides
   guidance on setting NSEC3 parameters based on recent operational
   deployment experience.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-dnsop-nsec3-guidance/

There is also an htmlized version available at:
https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-nsec3-guidance-00

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Florian Obser <[email-masked]>
Date: Wed, 26 May 2021 20:29:48 +0200

I finally got around to use a more sensible setting for my personal
domains, i.e. the recommended one.

I did have to refresh my memory on how NSEC3PARAM works by glancing at
RFC 5155 though. Maybe something like this at the end of
"3. Best-practice for zone publishers" would be helpful:

| Since the NSEC3PARAM RR is not used by validating resolvers (see
| [RFC5155] section 4) the iterations and salt parameters can be changed
| without the need to wait for RRsets to expire from caches.  A complete
| new NSEC3 chain needs to be constructed and the zone resigned.

Section 2.4 is already hinting at this, this spells it out.

Thanks,
Florian
-- 
I'm not entirely sure you are real.

---

From: Wes Hardaker <[email-masked]>
Date: Fri, 28 May 2021 10:57:19 -0700

> "3. Best-practice for zone publishers" would be helpful:

Thanks for the suggested text, added!
-- 
Wes Hardaker
USC/ISI