Subject: rollling salt/iterations/hash

From: Ben Laurie <[email-masked]>
Date: Wed, 04 Aug 2004 02:55:26 +0100

Sam suggested during the WG meeting that there might be an issue with 
rolling salt, iterations or hash in NSEC++, namely that the zone might 
be unprotected during such a roll. I don't understand why he thinks 
this, but let me say I don't believe it is correct. Since each NSEC++ 
record contains the parameters used to generate it, when a client 
receives one as a negative response, it has everything it needs to check 
that the interval contains the hash of the request, regardless of 
whether it gets the "pre-roll" or "post-roll" version of the record (of 
course, they will almost certainly correspond to completely different 
records in the zone, but this is unimportant).

Cheers,

Ben.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>