Subject: Re: Online signing

From: Alex Bligh <[email-masked]>
Date: Fri, 11 Jun 2004 18:45:29 +0100

--On 11 June 2004 17:28 +0000 Paul Vixie <[email-masked]> wrote:

> who only want to know
> if they can forward the dnssec-bis docset to the IESG.

did they not ask for comments on -trans?

I am assuming here that it is relevant point to make, that although the
consensus on the WG is not to fix NSEC in -bis, this will likely cause
certain operators not to deploy until -ter; isn't that what transition
is all about?

Alex

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Ben Laurie <[email-masked]>
Date: Fri, 11 Jun 2004 20:09:44 +0100

Paul Vixie wrote:
>>>I hope the assumptions one might have about a crypto-driven DDoS attack
>>>is hereby tuned to a non-issue.
>>
>>I can't agree that having to deploy expensive crypto accelerators makes
>>anything a non-issue.
> 
> then you're having a different conversation than the rest of us.
> 
>>What I would agree is that it makes it a soluble issue.
> 
> anything that can be solved outofband is a nonissue for dnssec-bis @IESG.
> 
> the conversation at hand is, can we send dnssec-bis to the IESG.
> 
> you appear to be saying "yes", both in the above "makes it soluble" comment
> and in your agreement with my dnssec-ter-01 draft.
> 
> any issue like "the crypto boards will cost too much" isn't relevant.  any
> issue like "online NSEC synthesis will expose the signing key to attacks
> because the attacker can force the victim to do unsalted crypto" is relevant.
> 
> i realize that these issues are equally near and dear to you.  but they are
> very different from the point of view of our chairs, who only want to know

Its not clear to me that the crypto boards will even exist, but that's 
not the important issue, as you say. What is important is exposure of keys.

However, I'm leaning towards the vastly cheaper and safer option of 
having a single (or two) NSEC record(s) that can be used for all denials 
as the interim measure of choice.

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff