Subject: RE: Wild, raving NXT lunacy (Re: Zone secure bit)

From: Philip Hallam-Baker <[email-masked]>
Date: Thu, 13 Apr 2000 15:10:41 -0700

>Can we perhaps hold off a bit on radically revising DNSSEC until we actually
>get a bit of field experience with a full implementation?  (I find it
>distressing this would even need be asked).

I would second this (but this is IETF so no votes).

The world is already set to deploy PKI infrastructure requiring far more
signatures per day than DNS without undue concern. There is plenty of 
very fast crypto hardware arround.

However great the number of DNS names, I'll wager that the number of
transactions occuring between the names will be significantly larger.
Systems like Identrus envisage using a lot of signatures to support
the likes of OCSP.

If the worst comes to the worst we can lash together a couple of 
thousand inmos transputers and have that do zone signing. Extrapolating
from the Athalon figures that would allow us to sign a .com zone
for 6 billion people in about one week - enough for one name each
on the basis of a decade old technology. Modern crypto processors
plugging into a PC via a USB hub could probably do the job quicker
and for less and bring a FIPS rating into the bargain.

Furthermore I think that a clear distinction needs to be drawn between 
optimization (using the least bits) and preventing catastrophic failure
(death of the Internet, news at 11).

The demand for DNS names is growing exponentially, ergo if preventing
catastrophic failure depends on design tolerances of 30% or even 100%
we have big trouble. We need headroom of an order of magnitude at least.

Thus the threshold for claiming an issue to be one of catastrophic 
failure rather than an optimization needs to be quite high.

		Phill

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.