Subject: Re: part II - Re: Remarks on the DNS Security Extension Clarification on Zone Status draft

From: Olafur Gudmundsson <[email-masked]>
Date: Fri, 26 May 2000 14:42:32 -0400

At 10:59 AM 5/26/00 , Roy Arends wrote:

>About the Draft: 
>Perhaps a clarification of secured entry-points, and the possible
>existance of "mini trusted trees" is useful.
>

Agreed, 

>Our tests to deploy DNSSEC on the largest ccTLDs convinced us that
>a NULL-KEY is not so bad in terms of size and effort, that it calls
>for a major update of the current proposed standard. (NULL-KEY's
>are temporal, small, and signing them is not a big issue.)
>We think it is best to put our effort to do large scale testing of
>the current RFC.

If you and the other entity the one that operates .com agree that
you can live with NULL keys for 90% of your delegations for the 
for seeable future, then there is no need to get rid of NULL keys. 
The MAIN motivator for this proposed change was the desire to reduce
storage requirements in the TLD servers. 
COM right now is say 10M delegations. If they sign the zone with DSA keys
then they will have 9M NULL keys records and signatures taking at least 
900MB of storage.
If on the other hand the KEY bit off the NXT record is overloaded
then these 18M RR's will not have to be loaded.

This is a tradeoff between recurring storage/reload/signing cost
versus a some extra code in all implementations.

	Olafur

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Jerry Scharf <[email-masked]>
Date: Fri, 26 May 2000 12:48:54 -0700

I think that an incremental signer and working incremental transfer would go a 
long way to making the issue of big zones with mostly NULL keys manageable. As 
bad as it sounds, 900MB of extra stuff that is not changed very often can work 
OK.

As long as you need something that is signed to come back, the issues related 
to message size and lack of EDNS0 are still the biggest issues for the TLD 
servers.

jerry