Re: [dnsext] NSEC3 and elliptic curve signatures

[Francis Dupont <[e-mail]>]

 In your previous mail you wrote:

   Do folks here think that draft-hoffman-dnssec-ecdsa should have
   suggested RFC 5155 iteration counts?
   
=> I think so. I suggest: you pick a stock hardware, evaluate performance,
compute proportional maximum iteration counts, and put values in
the next version of the draft if needed, i.e., if the reasoning 
for DSA apply for ECDSA too:

   The ratio between SHA-1 calculation and DSA verification is higher
   (1500 to 1 for keys of size 1024).  A higher iteration count degrades
   performance, while DSA verification is already more expensive than
   RSA for the same key size.  Therefore the values in the table MUST be
   used independent of the key algorithm.

IMHO it applies and the 150 default maximum value is still fine,
but it should be checked and written down.

Thanks

[e-mail]