Re: Transition from 2535 to opt-in

[Derek Atkins <warlord@MIT.EDU>]

Roy Arends <Roy.Arends@nominum.com> writes:

> If the "DNSSEC was not designed as a defense against DoS attacks" is used
> as a general statement, why aren't NXT and SIG generated on the fly ?
> EXACTLY, to make sure the system will not be used against a DoS.

Well, partially.  They are not created in real-time because the data
is quazi-static.  Why re-sign the same data over and over when you can
sign it once and re-use the signature?  Also, creating signatures is
an _expensive_ operation.  It was even more so 5+ years ago when 2535
was being written.

-derek

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
       warlord@MIT.EDU                        PGP key available


to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.