Subject: Re: NSEC3 chain walking

From: Peter Koch <[email-masked]>
Date: Tue, 01 Nov 2005 16:45:31 +0100

Ben Laurie wrote:

> We decided in
> http://www.ietf.org/internet-drafts/draft-ietf-dnsext-signed-nonexistence-req
>uirements-02.txt
> that it was "nice to have" and not an actual requirement.

not to question your assessment in this case, but the message should
probably be that "we" (be that the editors or the WG) should be careful
about other people's requirements, especially if they are crucial for a
deployment success.

It might be quite easy to get feedback from TLD registries, but there are
other DNS operators who may not have made their mind and, if they do, might
disagree with the above categorization (as "nice to have").

When it comes to "zone size" and "zone enumeration", it's also important
to view the first order differential, i.e. dies NSEC++ make it easier (than
pre-DNSSEC DNS) to find the [number of] changes applied to zone?
(This is not to introduce new hurdles, just completeness of the requirements
list).

-Peter

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>