Re: [dnsext] Authenticated denial of existence...

[Mark Andrews <[e-mail]>]

You may want to have some discussion about the pointlessness of
NSEC3 in highly structured zones like ip6.arpa and in-addr.arpa.
These can be walked even with NSEC3 due to their structure.

You may want to point out that a NSEC proves the existance of all
empty non-terminals between the two names in it hence contains the
closest provable encloser.

There is a bias that NSEC3 is better than NSEC.  They are just
different.  NSEC3 is actually worse for the typical trivial zone
as it doesn't help with zone walking as you can guess the names and
adds pointless computational load on both authoritative servers and
validators.

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]