Subject: Re: NSEC3-01 - more wildcard nits

From: Alex Bligh <[email-masked]>
Date: Fri, 01 Apr 2005 11:27:08 +0100

--On 01 April 2005 11:11 +0100 Geoffrey Sisson <[email-masked]> wrote:

>>                                 Although the two do not interfere, the
>> reason for NSEC* is that NSEC shouldn't exist.
>
> As I see it the reason for NSEC* is that enumeration is an issue for
> some (maybe many) DNS operators, but certainly not all.  I don't see
> why multiple denial of existence methods can't coexist.  NSEC3 requires
> authoritative name servers to do more work (hashing QNAMEs), so if
> enumeration isn't an issue then NSEC would be the method of choice.

NSEC3 with an identity hash algorithm would fulfil that goal. We already
have other reasons to do that (see my post re long names). (that doesn't
mean they *can't* coexist of course, I'm just not yet sure they need to).

Alex

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Jim Reid <[email-masked]>
Date: Fri, 01 Apr 2005 11:45:14 +0100

>>>>> "Geoffrey" == Geoffrey Sisson <[email-masked]> writes:

    Geoffrey> I don't see why multiple denial of existence methods
    Geoffrey> can't coexist.

Well for starters, there's the extra complexity for implementors and
applications developers. Not to mention the additional complexity in
configuring and operating name servers. This then creates added
administrative and policy problems: what does something do if a zone
is signed but not with its preferred (only?) DoE method? What if a
zone gets (accidentally?) signed using multiple DoE methods -- silly I
know -- assuming they aren't mutually exclusive (syntactically or
semantically)? Or will it be one zone, one method? How many DoE
methods is "too many": 2? 10? 100?