Subject: NSEC3 Issue 19: NSEC3 processing order

From: Ólafur Guðmundsson<[email-masked]>
Date: Mon, 05 Jun 2006 10:52:19 -0400

<no hat>

Issue: Should the document specify a recommendation about if a validating
resolver should process first
	the range of NSEC3 names covers query name
or	the signature on the NSEC3 records is valid

Discussion:  RFC4035 specifies/recommends that validating resolver first
check that the name range applies before validating the signature, as that
is the less expensive operation. For a NSEC3 with high iteration count it
is possible that validating the signature is less expensive than checking
the name range.

Resolution:
None at this point 

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Roy Arends <[email-masked]>
Date: Mon, 5 Jun 2006 23:16:11 +0200

> is possible that validating the signature is less expensive than 
checking

I think it is fine to have the draft include a note on this specific 
implementation recommendation, absent of any MUST or SHOULD.

Regards,

Roy

---

From: "Scott Rose" <[email-masked]>
Date: Tue, 6 Jun 2006 09:15:21 -0400

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Roy Arends
> >

I agree - just mention the trade-off but give no implementation constraint.

Scott