Subject: Re: part II - Re: Remarks on the DNS Security Extension Clarification on Zone Status draft

From: Roy Arends <[email-masked]>
Date: Mon, 29 May 2000 12:04:54 +0200 (CEST)

On Fri, 26 May 2000, Olafur Gudmundsson wrote:

> If you and the other entity the one that operates .com agree that
> you can live with NULL keys for 90% of your delegations for the 
> for seeable future, then there is no need to get rid of NULL keys. 
> The MAIN motivator for this proposed change was the desire to reduce
> storage requirements in the TLD servers. 
> COM right now is say 10M delegations. If they sign the zone with DSA keys
> then they will have 9M NULL keys records and signatures taking at least 
> 900MB of storage.
> If on the other hand the KEY bit off the NXT record is overloaded
> then these 18M RR's will not have to be loaded.

It's not that we object against replacing the NULL-KEY with a bit in
the NXT record. But we do have problem with the interpretation that the
draft <draft-ietf-dnsext-zone-status-01.txt> proposes for the bit in the
NXT record, because this differs in a subtle, but fundamental way
from the meaning of a parent holding a NULL-KEY.

The former says:
- the parent has signed a KEY for this child
The latter says:
- the child is clueless

We are affraid that this difference leads to unforseen
complications.

If the draft would have proposed that the meaning of a KEY bit set
in the NXT RR   AND   no KEY RR is present, were : 
   "a NULL-KEY is implied"  
we would not have this problem. This would then also be downward
compatible.

Regards,
Roy and Ted.

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Edward Lewis <[email-masked]>
Date: Mon, 29 May 2000 09:15:17 -0400

>we would not have this problem. This would then also be downward

I think this is where I am heading with the draft.

The bit would be on if the parent signs a key set for the child that
includes a zone key, hence "securing" the child.

The problem with allowing both the NULL KEY to signify an unsigned child
*and* a bit setting in the NXT is that this complicates life for the
resolver (and I don't mean that only the code is hard to write).

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                NAI Labs
Phone: +1 443-259-2352                      Email: [email-masked]

"It takes years of training to know when to do nothing" - Dogbert

Opinions expressed are property of my evil twin, not my employer.