Re: [dnsext] we need help to make names the same, was draft-yao-dnsext-identical-resolution-02 comment

[Masataka Ohta <[e-mail]>]

Nicholas Weaver wrote:

> Random reported SSL setups per second are ~1500/s for a commodity
> 64B processor with 1024B keys.

I think you are saying 1024b keys.

That's a lot slower than typical number on TCP connections per
second, which means computation load dominates.

Considering the following statement in RFC5507 (April 2009):

   DNS queries over TCP are not subject
   to this length limitation, but TCP imposes significantly higher per-
   query overhead on name servers than UDP.

dynamic generation is not feasible at all.

> AND such compute nodes could cache the signatures for
> common conventions, which means you can't computationally
> DOS the common cases

DOS will clear the cache. Worse, multiple layers of labels
increase the number of common cases exponentially, unless
you introduce redirection by BNAME.

> 2048B signatures are only ~4x harder than 1024B signatures
> computationally to GENERATE,

As 2048 is not very large that Karatsuba Multiplication is
not very effective.

> but vastly harder to crack using brute force.

If it were vastly harder we should be using 520b key, if 512b
key was good enough 15 years ago.

						Masataka Ohta