Subject: [DNSOP] NSEC3 Guidance - zone size impact of opt-out

From: Alexander Mayrhofer <[email-masked]>
Date: Fri, 3 Sep 2021 09:16:54 +0200

Wes, all,

thanks for putting together draft-ietf-dnsop-nsec3-guidance. I have
one small comment regarding section 2.2 (Flags):

In some deployments of larger (eg TLD), in-memory zone size on the
authoritative servers is a significant issue, particularly if the
total memory size required is multiplied by hundreds of anycast nodes.
Opt-out for such zones with sparse DNSSEC deployment can make a big
operational / cost difference there. Maybe that aspect should be
included in the document.

thanks!
Alex

---

From: Paul Wouters <[email-masked]>
Date: Fri, 3 Sep 2021 03:32:56 -0400 (EDT)

> total memory size required is multiplied by hundreds of anycast nodes.

Why would you calculate the cost of memory across many independent
nodes? That seems to become a financial rather than technical issue.

> included in the document.

I myself think we have reached the point where memory on nodes is so
cheap, it is not worth the security degradation to use opt-out.

I guess with aggressive nsec, you might even gain some CPU cycles back
for that extra memory used, and receive less queries too? Saving you
some money?

Paul

---

From: Vladimír Čunát <[email-masked]>
Date: Fri, 3 Sep 2021 09:48:56 +0200

> for that extra memory used, and receive less queries too? Saving you

I think these savings won't be significant in delegation-centric zones 
that are huge enough to consider opt-out.  (But from TLDs I'd perhaps 
only consider .com to be huge enough.)  For resolvers the memory issue 
is even more significant, because they share it for *all* zones, so you 
can't expect them to keep a significant fraction of huge zones in 
cache.  Without being delegation-centric you could at least noticeably 
utilize one NODATA answer to deny all missing types at the name (A + 
AAAA is a typical queried pair, to be joined by HTTPS).

--Vladimir | knot-resolver.cz

---

From: Vladimír Čunát <[email-masked]>
Date: Fri, 3 Sep 2021 10:02:29 +0200

On 03/09/2021 09.48, Vladimír Čunát wrote:
> you can't expect them[resolvers] to keep a significant fraction of 
> huge zones in cache

That being said, if a zone with (only) a couple million entries is 
*attacked*, it can be realistically protected by aggressive caching.  A 
cache of a couple GB seems OK for big resolver instances, so even the 
whole NSEC* chain of the attacked zone might fit.  Simple experiments: 
https://indico.dns-oarc.net/event/28/contributions/509/

---

From: Ray Bellis <[email-masked]>
Date: Fri, 3 Sep 2021 09:58:42 +0100

> cheap, it is not worth the security degradation to use opt-out.

Generic DIMMs are indeed cheap.

However, supported ones from server vendors such as Dell have a retail
price about 4x the consumer price (e.g. ~ $900 for 32GB).

If your nodes are staffed, by all means drop in cheap generic memory and
be prepared to swap it for the real stuff if you have a hardware issue
that needs warranty repair.  For remote nodes that's not practical.

Ray

---

From: Viktor Dukhovni <[email-masked]>
Date: Sat, 4 Sep 2021 12:05:24 -0400

On Fri, Sep 03, 2021 at 09:48:56AM +0200, Vladimír Čunát wrote:

> only consider .com to be huge enough.)

This is my take as well, essentially only .COM (>150M delegations) is so
large that presently there's still a compelling case for opt-out.

The next batch of large TLDs (.DE, .NET, .ORG, ..., with >10M
delegations) are ~10x smaller, and at these scales already the benefit
of opt-out is much lower.  Indeed prior to COVID-19, IIRC .ORG was
slated to switch to NSEC, but that got postponed.

Even .COM may before long reach a signed delegation rate where opt-out
starts to become less compelling (presently just 2.63%, but already
much higher recent levels):

    https://stats.dnssec-tools.org/tld-graphs/com.png

The .CH TLD has recently introduced DNSSEC incentives, and the signed
delegations are rising dramatically, soon to a level where opt-out will
make little difference:

    https://stats.dnssec-tools.org/tld-graphs/ch.png

The .SK TLD has recently issued a press release about reaching 50%
signed delegations in record time:

    https://sk-nic.sk/we-are-one-of-the-best-in-dnssec-domain-security/

Joining the ranks of the .NO, .CZ, .NL and .SE ccTLDs, which all have
more than 50% of their delegations signed.  (The .bank and .insurance
TLDs which have a 100% signing mandate are at least two orders of
magnitude smaller).

-- 
    Viktor.

---

From: Wes Hardaker <[email-masked]>
Date: Fri, 24 Sep 2021 06:21:23 -0700

> one small comment regarding section 2.2 (Flags):

After reading the conversation, I think the easiest thing to do is add
this:

or when using memory-constrained hardware.

To the end of the reasons sentence, which I've just done.

Thanks for the comment!
-- 
Wes Hardaker
USC/ISI