Re: PKS, and the DV/MD choice...

[Matt Crawford <[e-mail]>]

A little untimely, but I don't see where anyone else made this point:

> 	In an MD system, you should only get updates from R1 when the
> topology next to R1 changes (i.e. it's connect to some other router, or a
> piece of the nework, changes), and each topology change is *guaranteed* to
> send you only a small amount of data (i.e. what R1 is connected to now). I.e.
> you don't get all of whatever routing table entries have changed - which
> could be a lot of data items, each one of which would have to be checked, 

Now you have a large signed item describing old state and a small
signed item describing changes.  Either
	1) You can propagate the former and suppress the latter
or	2) All data expires and is often being re-sent and re-checked
or	3) The source of the data is somehow able to propagate the
	   data past you by some means with which you can't interfere.

I don't believe (3).  (2) either loses big or sets a bound on routing
convergence time.  (1) isn't a fix, just a partial fix and probably a
net waste of effort.

It seems to me that the time to check N bytes of data is AN+B, where
A is the inverse-speed of your hashing function and B is the time to
do a public-key computation.  Certain ranges of a and b favor sending
only complete topology information (or at least, complete at a given
level of abstraction) rather than incremental updates.

				Matt Crawford