Subject: Re: [dane] Draft for serializing DNSSEC chains

From: "Jim Schaad" <[email-masked]>
Date: Wed, 18 Apr 2012 18:11:41 -0700

Adam,

In another context I am looking at using a dane serialization, however one
of the things that I don't have a good handle on at the moment is the size
of the serialized chain.  I realize that this is highly dependent on things
like the type of key and number of keys.  However did you develop any
metrics on the size of chains based on what you did?

Jim

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Adam Langley
> Sent: Tuesday, June 28, 2011 11:23 AM
> To: [email-masked]
> Subject: [dane] Draft for serializing DNSSEC chains
> 
> As promised. (This is also the format that Chrome is using for it's DNSSEC
> stapled certificate support.)
> 
> http://tools.ietf.org/html/draft-agl-dane-serializechain-00
> 
> 
> Cheers
> 
> AGL
> 
> --
> Adam Langley [email-masked] http://www.imperialviolet.org
> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane

---

From: Adam Langley <[email-masked]>
Date: Mon, 23 Apr 2012 12:52:52 -0400

> metrics on the size of chains based on what you did?

I think the answer is that it's larger than I would like. ~2KB is
about the minimum that you can hope for assuming that you're not a TLD
yourself. I think you best bet is to grab the (somewhat rough) tools
[1] and play around.

[1] https://github.com/agl/dnssec-tls-tools

Cheers

AGL