Subject: Re: Q2: crypto algorithm requirements for DNSSEC

From: Jakob Schlyter <[email-masked]>
Date: Thu, 13 Feb 2003 13:09:25 +0100 (CET)

On Thu, 13 Feb 2003, Jim Reid wrote:

> Well zone size is one consideration.

maybe for .de and .com, otherwise I doubt that is a real problem.

> Another would be the extra time and resources needed to sign the same
> data with different algorithms.

I wouldn't consider the resources used for signing a problem with modern
hardware - people sign .com with their desktop machine within reasonable
time.

	jakob

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Jakob Schlyter <[email-masked]>
Date: Thu, 13 Feb 2003 14:22:45 +0100 (CET)

On Thu, 13 Feb 2003, Miek Gieben wrote:

> so you're asking a TLD to carry twice the load for an event which is unlikely
> to happen soon?

yes, if we come to the conclusion that we should use two algorithms.

> And further more, we (.nl), have to explain to every domain holder in
> .nl that signing with 2 algorithms is better than signing with 1.

if we cannot explain why to normal people, I'm not sure we should do two
algorithms.

	jakob

---

From: Miek Gieben <[email-masked]>
Date: Thu, 13 Feb 2003 14:01:03 +0100

[ post by non-subscriber.  with the massive amount of spam, it is easy to miss
  and therefore delete posts by non-subscribers.  if you wish to regularly
  post from an address that is not subscribed to this mailing list, send a
  message to <listname>[email-masked] and ask to have the alternate
  address added to the list of addresses from which submissions are
  automatically accepted. ]

[On 13 Feb, @13:09, Jakob wrote in "Re: Q2: crypto algorithm requi ..."]
> maybe for .de and .com, otherwise I doubt that is a real problem.

true, the size of .nl would be something of 600 MB (with 768 bits keys).
This can be handled.

so you're asking a TLD to carry twice the load for an event which is unlikely
to happen soon? And further more, we (.nl), have to explain to every domain
holder in .nl that signing with 2 algorithms is better than signing with 1.
I think that will be very hard to do and enforce.

grtz Miek

---

From: [email-masked]
Date: Fri, 14 Feb 2003 08:34:34 +1100

> signing and verifying => making deployment more straightforward. And
> ISTR from cryptography 101 class that it's usually not a good idea to
> encrypt or sign the same stuff with different keys or algorithms.

	Encrypting things multiple times is a problem.
	Signing the same known plain text isn't.
--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]