Subject: some issues with NSEC3, based on the workshop last week

From: Edward Lewis <[email-masked]>
Date: Wed, 17 May 2006 18:00:53 -0400

On a conference call I listed a few concerns I had with NSEC3 based 
on the workshop held last week.  The list here isn't in response to 
any document, nor is it necessarily complete nor well-supported.  For 
the sake of "entering it into the record" here are things that I 
still see open ended with regards to NSEC3.  (Some of these were in 
the jabber log, some have been added with a few more minutes of 
contemplation.)

1) No transition plan yet. (An earlier email went out on this).

2) No coexistence plan (I haven't see anyone test NSEC and NSEC3 in 
the same tree) or testing.  Can NSEC and NSEC3 coexist in the field, 
or will there be pressure to choose one?  Registry operators cannot 
be easily divided into gTLDs, ccTLD, ENUM registries anymore, usually 
the same functions will be under the same roof.  Ergo, I don't think 
it's safe to write off NSEC3 as not appropriate for, say, what's in 
.arpa.

3) The need for debugging tools and hooks.  (Tool development is not 
the IETF's baliwick, but it is a concern to operations.)

4) Why is the number of iterations a parameter?  Why can't we just 
use one number and reply on the degree of freedom provided by the 
salt.  Can there be a limit to the length of the salt to prevent 
abuse?

5) Is there an opportunity for a malevolent configuration to turn 
NSEC3 into an attack vector on resolvers, is there a way to make it 
an amplifier of activity?

6) Is opt-in necessary for NSEC3 or are they different issues?  Could 
NSEC3 be defined without having the complexity of analyzing opt-in 
for the first go-round?

7) What is the toll on verifiers when the salt (and iterations) are 
not uniform in the NSEC3 records presented?  Is there someway to hide 
the latency of calculating the hashes needed to start validating of 
negative answers in the resolver?

8) What will this look like to recursive servers, caching, and 
negative caching? This is an open issue as we didn't test this in the 
workshop.  WHat does it look like if a zone has just turned on NSEC3, 
turned it off?  See #1.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

Nothin' more exciting than going to the printer to watch the toner drain...

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>