Subject: Why I want to remove the null key SIG

From: Edward Lewis <[email-masked]>
Date: Tue, 30 May 2000 11:09:23 -0400

This relates to the thread on the DNSSEC Clarification on Zone Status
draft, but I wanted to separate this to draw comments on an issue that is
not directly addressed by the draft.

Removing the null KEY is rumored to drop a signed, widely-delegated zone by
about a third.  As has been pointed out, this is sizeable, but not sizeable
considering the monthly rate of increase in domain name registrations
experienced in some of the up-and-coming TLDs.

The obvious rationale is that removing a third of the records would make
DNSSEC more adoptable by limiting the up-front resource investment.

A less obvious rationale is that saving space now may help in the
transition out of DNSSECv1 to DNSSECv2 (let's face it, it will happen).  I
envision that there may be a need to create a new record at a parent to
indicate something about the child.  This is an idle thought - not only am
I reluctant to persue a draft on this, I think it is premature to even
guess of how or what form such a transition may take.

In case you are wondering - I don't think the addition of the
aforementioned record is a foregone conclusion.  I am trying to identify
ways that reduce the amount of information a parent must know and hold
about a child.

Will the introduction of parent-authoritative data at a delegation point
prove to be DNSSEC's biggest faux pas?  Will the weakness of DNS delegation
indication  (no delegation record) be a problem to DNSSEC?  Will dynamic
update make the delegation information more consistent, sophisticated,
reliable?

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                NAI Labs
Phone: +1 443-259-2352                      Email: [email-masked]

"It takes years of training to know when to do nothing" - Dogbert

Opinions expressed are property of my evil twin, not my employer.

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.