Subject: Re: Why I want to remove the null key SIG

From: [email-masked] (Ted Lindgreen)
Date: Wed, 14 Jun 2000 10:12:47 +0200

[Quoting Bill Manning, on Jun 14,  1:12, in "Re: Why I want to re ..."]

> % On what grounds do you come to this conclusion? Do you have any
> % data to support this?
> % 	jaap
> 
> Ok, I'll admint some unlisted assumptions. 
> 	) zones should be signed in a timely manner e.g. less than 4hours
> 	) COTS technologies today are represented by 1 or 2 G of memory,
> 	  subGhz processors.
> 	) large flat name spaces have around 1 million entries
> 
> tests done in the US on some large zones (com.) and some tests done in 
> Europe (de.) indicate that with current COTS and these zones, the time
> test fails. 

I'm not sure to which test for the .de you are referring, but they
are in contrast with the only tests for European ccTLDs we have
seen sofar.  These were performed by NLnet Labs for a CENTR
workgroup on DNSSEC and published on this list two months ago.

The NLnet Labs tests showed, that using a $ 1000,- PC, the .nl and
.se zones were signed in minutes, and the .de zone (currently the
largest ccTLD with over 2 M delegations), was signed in some 4 hours.

For detailed info about the .de signing test please see:
 http://open.nlnetlabs.nl/dnssec/de-signing.txt

The conclusion of NLnet Labs was that there are no technical problems
that prevent implementing DNSSEC in its current form for even the
largest ccTLDs.  The 4 hours needed to sign the .de zone can be
easily reduced further, for instance by:

- using more powerful hardware.
- signing incrementally.

-- Ted.

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.