Re: DNSSEXT Yokohama Minutes

[Olafur Gudmundsson <ogud@ogud.com>]

On Tue, 3 Sep 2002, Roy Arends wrote:

> On Tue, 3 Sep 2002, David Blacka wrote:
>
> > >>>>> "ogud" == Olafur Gudmundsson <Olafur> writes:
> >
> >  ogud> This will not happen on my watch, but Opt-in camp needs to
> >  ogud> answer the open questions in their open park.
> >
> > Could somebody please restate the open questions about opt-in?  Feel
> > free to add new open questions.
>
> As I recall, we need to write:
>
> - The impact on: Authoritative servers (but this is already clear in draft
>                  IMHO)
>                  [caching] resolvers (basically the change to the resolver
>                  algorihm)
> - The current issues:
>                  Clear AD-bit on an opt-in response.
>                  (I think this will be taken care of by the "AD-bit is
>                  secure" authors ).

This is for Opt-in to specify, not AD due to dependancy reasons, this
definition is only needed if both AD and Opt-in are part of the standard.

For the record: this relates to use of NXT between the two names
on the NXT (record name and the target name).
In DNSSEC where AD bit is used (either RFC2535 or AD-secure definition),
the AD bit can be set on responce if it is authenticated denial with NXT,
for the QNAME if the
	NXTNAME  == QNAME or (NXTNAME < QNAME and QNAME < NXTargetNAME )

Opt-in NXT must define that this that NXT can only be used when
NXTNAME == QNAME to set the AD bit.

> Some of the above were stated by Olafur last week during the DS workshop,
> others were a result of research by Rob Austein and me (which was
> presented at Yokohama).

Then there is the minor issue of bytes on the wire, are responses
from Opt-in zones smaller/same/larger than from regular DNSSEC zones.

And then there is the issue on memory usage in caches, there was an
assertation that opt-in zones cause more memory consumption than other
DNSSEC zones.

	Olafur



--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>