Subject: [dnsext] NSEC3 and elliptic curve signatures

From: Paul Hoffman <[email-masked]>
Date: Thu, 16 Sep 2010 09:55:59 -0700

Greetings again. draft-hoffman-dnssec-ecdsa describes DNSSEC signature algorithms using the two generally-accepted elliptic curve sizes on 256 and 384 bits. Dan Simon pointed out to Wouter and I that RFC 5155 talks about choosing iteration sizes for DSA and RSA, but not elliptic curves. Wouter ran some numbers that could be used to determine possible iteration counts, but RFC 5155 only sets maximums for iterations, not suggested values.

Do folks here think that draft-hoffman-dnssec-ecdsa should have suggested RFC 5155 iteration counts? Should we discuss it at all?

--Paul Hoffman, Director
--VPN Consortium

---

From: "Rose, Scott W." <[email-masked]>
Date: Thu, 16 Sep 2010 14:05:40 -0400

FWIW, those that produce operational recommendations will have to answer this if it is not in the draft.  Those values will likely vary.  While this isn't a show-stopper, but it may cause administrator confusion.

I think a good gauge should be to have the max iterations recommendation be less than the time it takes to validate the RRSIG for "an average system".  I don't have an idea what the hard numbers would be.

Scott

> Do folks here think that draft-hoffman-dnssec-ecdsa should have suggested RFC 5155 iteration counts? Should we discuss it at all?

===================================
Scott Rose
NIST
[email-masked]
+1 301-975-8439
Google Voice: +1 571-249-3671
http://www.dnsops.gov/
===================================

---

From: Francis Dupont <[email-masked]>
Date: Fri, 17 Sep 2010 16:12:28 +0200

In your previous mail you wrote:

   Do folks here think that draft-hoffman-dnssec-ecdsa should have
   suggested RFC 5155 iteration counts?
   
=> I think so. I suggest: you pick a stock hardware, evaluate performance,
compute proportional maximum iteration counts, and put values in
the next version of the draft if needed, i.e., if the reasoning 
for DSA apply for ECDSA too:

   The ratio between SHA-1 calculation and DSA verification is higher
   (1500 to 1 for keys of size 1024).  A higher iteration count degrades
   performance, while DSA verification is already more expensive than
   RSA for the same key size.  Therefore the values in the table MUST be
   used independent of the key algorithm.

IMHO it applies and the 150 default maximum value is still fine,
but it should be checked and written down.

Thanks

[email-masked]