[DNSOP] On Powerbind

[Ben Schwartz <[e-mail]>]

If I understand correctly, the Powerbind draft is designed to reduce the
amount of data that must be logged in order to verify appropriate use of a
DNSKEY "K" for a delegation-only zone.  I'm trying to compare the amount of
logging required with and without Powerbind.

Here's my current best guess:
- With Powerbind, we need to log all DS records (to detect replacement) and
NSEC and NSEC3 records (to detect repudiation) that are signed by K, along
with their RRSIGs.  Resolvers would reject any other records signed by K.
- Without Powerbind, we need to log any record signed by K that is not on
the apex, along with its RRSIG.

But for a delegation-only zone, aren't these the same set?  What else would
a delegation-only zone be signing beyond the apex, other than DS, NSEC, and
NSEC3?

Thanks,
Ben Schwartz

P.S. Hostile zones can spam the log either way, so that problem is out of
scope.