Re: [dnsext] we need help to make names the same, was draft-yao-dnsext-identical-resolution-02 comment

[Tony Finch <[e-mail]>]

On Wed, 23 Feb 2011, Nicholas Weaver wrote:
> On Feb 23, 2011, at 12:00 PM, Phillip Hallam-Baker wrote:
> >
> > True, but data origin authentication is probably the wrong model for a
> > DNS security scheme.

If you want to argue that, please get in your time machine and go back to
1993.

> > If we are going to consider changing the model of DNSSEC, which is
> > what moving to online signatures would entail, then the whole
> > architecture is back on the table.
>
> Online signatures work within the existing DNSSEC model, you just need
> to be willing to pay the computational cost in the cases where it is
> necessary (eg, mixed-casing non-ascii)

You can predict in advance the maximum size of the signature cache you
will need (since it's the same size as a pre-signed zone) and once the
cache is populated the work you need to do is exactly the same as for
re-signing a static zone. There are some cases where the maximum cache is
unfeasibly huge, for example pool.ntp.org, in which case you might be able
to get away with a smaller cache (which implies more computational work)
or a more restricted data model.

See also
http://www.ietf.org/mail-archive/web/dnsext/current/msg08593.html
and Colm's follow-up.

Tony.
-- 
f.anthony.n.finch  <[e-mail]>  http://dotat.at/
Shannon, Rockall, Malin, Hebrides: Southwest 6 to gale 8, occasionally severe
gale 9 in Rockall, perhaps severe gale 9 later in Hebrides. Very rough or
high, occasionally very high in northwest Rockall and northwest Hebrides.
Occasional rain. Moderate or poor.