[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Denial Of Existence: Way Forward



Samuel Weiler wrote:
On Fri, 29 Oct 2004, Ben Laurie wrote:


If opt-in is dropped, then (from memory), the only remaining point
is whether hashing is done per-label or over the whole name.


In San Diego, I did presentation comparing the two NSEC++ proposals,
but I don't think a summary ever made it to the list (sorry about
that).  The slides are in the meeting proceedings:

http://www.ietf.org/proceedings/04aug/slides/dnsext-7.pdf

To summarize, in addition to the choice of whether hashing is
per-label or not [1], the two proposals had three "options": opt-in,
allowing hash iterations, and defining a null hash function.  I think
we can pick and choose among these, and I think both the iteration
option and the null hash option are pretty trivial, but I don't recall
us making any decisions about them.

In my presentation, I also faulted both proposals for not describing
how to change hash functions or salts (or number of iterations)

I didn't understand this criticism at the time, and I still don't.

and
for not going into enough detail about wildcard processing.  Both of
those need to be addressed.  I also worried about hash collisions,
though people keep trying to convince me that the probabilities of a
collision can be made vanishingly small.  I'd rather see a mechanism
for rolling (or allowing for coexistence of multiple) hashs and/or
salts, but I'm willing to drop the collision concern.

The current draft of NSEC2 does allow for coexistence, since the salt and iterations are included in each record. I can't remember if that is a change.


[1] The choice of whether to do per-label or whole-name hashing could
require the introduction of an EXIST RR and other changes to wildcard
processing rules.  Each choice also reveals different information
about the zone: whole-name hashing (NSEC2) exposes the names of empty
non-terminals (via the EXIST RR); per-label hashing (DNSNR/NSEC3)
exposes the structure of the zone but not the names.

Good point.

--
ApacheCon! 13-17 November! http://www.apachecon.com/

http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>