Re: [DNSOP] Discussions of NSEC5
Shumon Huque <shuque@gmail.com> Wed, 29 March 2017 01:50 UTC
Return-Path: <shuque@gmail.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C483412956B for <dnsop@ietfa.amsl.com>; Tue, 28 Mar 2017 18:50:13 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.698
X-Spam-Level:
X-Spam-Status: No, score=-2.698 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2rFdqSIDJ0jy for <dnsop@ietfa.amsl.com>; Tue, 28 Mar 2017 18:50:12 -0700 (PDT)
Received: from mail-vk0-x22b.google.com (mail-vk0-x22b.google.com [IPv6:2607:f8b0:400c:c05::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 244BB1273B1 for <dnsop@ietf.org>; Tue, 28 Mar 2017 18:50:12 -0700 (PDT)
Received: by mail-vk0-x22b.google.com with SMTP id s68so2185454vke.3 for <dnsop@ietf.org>; Tue, 28 Mar 2017 18:50:12 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=/jbBbr7vmoam2WleYjED5m9MCiqdx5Hof5QVPt6oIM4=; b=kQ448aVpm0ue99TACxmmjIinGyJIEdu6FKw1bfV5e1xpWTvkwtV2idkvT4JDhw5s6X 8pSOVHQ9vdGyspRGuTiSf33DY5SLxIM7ZLcY9Ot3d8iKx1yDQqtEfgYessACZJZtkJpm Mszuedhsk9N4lNg6E5Bt9JMxRt5dmB6Y0MqTVYxlbUwQSD8dFFwr1X9bRuBYxLEHxcLz 6EG1GfZrlWDlJMuCdWf4oXT2A22oyfLgib1kqZs4ynPvnjuvwJz+WJwYrt1KpDDNZe3p shmH6/m4a1F/6zuCJi3dYADMMzcyTYQnBhRdGamImSAATJ/JeUKog8ejlrxLrRygz/en 242Q==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=/jbBbr7vmoam2WleYjED5m9MCiqdx5Hof5QVPt6oIM4=; b=E2lhFmUmE2oDu71b8E4vCQ71b84bqnvumr8s34wuyq8ThpptJ0bY32o1DVryRdO8Ul tj6TYr2EeHTHXbVRvqHqnJc4xFZ5GS1YvBs+wMAL6A32EIbOrVJvqio+3MBCIkFdLyX/ SKxmFlKYog1Npc4w80iEKJxsnOy/03eo5ra8sbn61yr2ufArt1FS6pIc6oeD7QVpL9Xe lAzVDUeLom8Za7s7yzKJAGr0LwA8foJtudB/2wkOA4DDd0bnbUduMK50Vf59OIgec9Sb D83MgiOT4Xcw+oJFga+QbToKtj9DyXf6AKIHtMN0HcndhTa8pEKy47+lLJHqfsJFMZMY KTFA==
X-Gm-Message-State: AFeK/H3svaoaW6Brj+pXjoW1qXnu/kCy/Ie4KKIVZAURoQtSxHOxNDVLFc/W5rDYue9/+9CqiMmrzEv8FoQfDw==
X-Received: by 10.159.40.135 with SMTP id d7mr15498453uad.122.1490752211184; Tue, 28 Mar 2017 18:50:11 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.176.84.207 with HTTP; Tue, 28 Mar 2017 18:50:10 -0700 (PDT)
In-Reply-To: <230235C0-8033-4D62-9FD2-DE366C7EA368@vpnc.org>
References: <230235C0-8033-4D62-9FD2-DE366C7EA368@vpnc.org>
From: Shumon Huque <shuque@gmail.com>
Date: Tue, 28 Mar 2017 20:50:10 -0500
Message-ID: <CAHPuVdXO4-kSieE0EC39Xzt3XLhUs+irSonETMfgGfxgbsZsEw@mail.gmail.com>
To: Paul Hoffman <paul.hoffman@vpnc.org>
Cc: dnsop WG <dnsop@ietf.org>
Content-Type: multipart/alternative; boundary="94eb2c123058fef513054bd4cb6c"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/GSRtLYrV40j_qnjY_bkINi102UQ>
Subject: Re: [DNSOP] Discussions of NSEC5
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 29 Mar 2017 01:50:14 -0000
On Tue, Mar 28, 2017 at 1:28 PM, Paul Hoffman <paul.hoffman@vpnc.org> wrote: [...] > - White Lies can be done with NSEC, not just with NSEC3. RFC 7129 calls > these "minimally covering NSEC records". I would think that doing NSEC > White Lies would require less CPU than doing NSEC3 White Lies (but I > haven't done the work to be sure). > I would say that's almost definitely true, but I haven't done the empirical work either. The reason Sharon's slides and the research paper only show performance results versus NSEC3 white lies is that was the only white lies implementation in a production quality open-source nameserver available/known to us at the time of the measurement work. -- Shumon Huque
- [DNSOP] Discussions of NSEC5 Paul Hoffman
- Re: [DNSOP] Discussions of NSEC5 Shumon Huque