Re: [dnsext] Name equivalence: No protocol change solution

[[e-mail]]

> From: Alex Bligh <[e-mail]>
>    OWNERNAME   IN   SNAME   TARGET
>    TARGET      IN   NS ...
>                IN   DS ...
> 
>> New DNS Server answers are:
>>
>>     QNAME            |          Answer
>>     -----------------+----------------
>>     OWNERNAME        |     OWNERNAME     IN CNAME TARGET
>>     SUB.OWNERNAME    |     SUB.OWNERNAME IN CNAME SUB.TARGET
>>     SUB.TARGET       |     TARGET IN NS + TARGET IN DS
>>     TARGET           |     TARGET IN NS + TARGET IN DS
>>     ...
>>
>> We can sign synthesized CNAME RR using RFC 4470.
>> It does not need new algorithm numbers.
> 
> I think you are not synthesizing NS/DS records or DNAME
> records for OWNERNAME (the 'copy').

Adding NS/DS with synthesized CNAME is OK, but not necessary.
Resolvers follow CNAME.

# Adding NS/DS with CNAME is very easy.

> The only NS/DS returned
> are for TARGET. You are synthesizing a CNAME for
> SUB.OWNERNAME and SUB1.SUB2.OWNERNAME even if SUB (in TARGET)
> would be beyond a zone cut.

if SUB.TARGET is zone cut, querying SUB1.SUB2.OWNERNAME is synthesized
"SUB1.SUB2.OWNERNAME CNAME SUB1.SUB2.TARGET" and the resolver can resolve
SUB1.SUB2.TARGET.

if SUB.TARGET is zone cut, querying SUB1.SUB.OWNERNAME is synthesized
"SUB1.SUB.OWNERNAME CNAME SUB1.SUB.TARGET" and the resolver can
resolve SUB1.SUB.TARGET even if SUB.TARGET is zone cut.

> If I am right about this, and OWNERNAME and TARGET are TLDs,

I intended that OWNERNAME and TARGET are second level domain name within 
a TLD which supports variant resolution.

> doesn't that mean that the TLD operator running OWNERNAME
> will have to do RFC4470 online signing for every query of
> every domain name within the OWNERNAME TLD?

the TLD's DNS server has to do RFC 4470 online signing for every query.

> To put it mildly,
> that would be a large increase in DNS traffic, and very expensive
> DNS traffic at that given the online signing requirement.

In my opinion, DNS traffic will not change because CNAME is cachable.

Online signing requirement is not so hard, I think.
Recent PC's CPU can sign 10000 RRs / sec (1024bit RSA).
Or using accelerator card solves performance problem.
We can write new DNS server and new online signer.

My program is very slow because it is written by perl.

--
Kazunori Fujiwara, JPRS <[e-mail]>