Subject: RE: NSEC version field (Re: NSEC2- and an Authenticated Denial M echanism Flag)

From: Edward Lewis <[email-masked]>
Date: Tue, 1 Jun 2004 15:35:34 -0400

At 12:40 -0400 6/1/04, Scott Rose wrote:

>The server needs to generate a hash of the queried name (and to find the
>closest encloser) to find which NSEC2 RR's to include in the response.

You might note that Ed's often a bozo and it'd be wise for all folks 
to check his work at all times.

>That's where the client dictates the work to the server, and the point Ed
>brought up.  I wonder if something like the EXIST RR can shorten this work.
>Just brainstorming, since I have no clue right now.

Actually, the server needs to find the closest encloser via normal 
matching, then compute on-the-fly the hash of the CE name plus one 
label of the query name.  For a name error response (NXDOMAIN), the 
server could either compute the wild card hash or pre-compute them 
all on load/dynamic update.  So, a server could cut this down to the 
one on-the-fly hash.

But then again - I still may be wrong...
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

Even the voices inside my head are refusing to talk to me anymore.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Ben Laurie <[email-masked]>
Date: Wed, 02 Jun 2004 12:35:35 +0100

Edward Lewis wrote:

> You might note that Ed's often a bozo and it'd be wise for all folks to 
> check his work at all times.
> 
> matching, then compute on-the-fly the hash of the CE name plus one label 
> of the query name.  For a name error response (NXDOMAIN), the server 
> could either compute the wild card hash or pre-compute them all on 
> load/dynamic update.  So, a server could cut this down to the one 
> on-the-fly hash.
> 

I believe this is correct - the server only needs to compute the hash of 
the requested name. Whether precomputation is worth the effort depends 
on parameters. Don't forget that hashes are really very fast.

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff