Re: [DNSOP] Key sizes was Re: I-D Action:draft-ietf-dnsop-rfc4641bis-01.txt

[Joe Abley <[e-mail]>]

On 24 Apr 2009, at 22:45, Paul Hoffman wrote:

> At 10:25 PM -0400 4/24/09, Joe Abley wrote:
>
>> My point is that given the choice between "doing what is currently  
>> considered safe" and "exceeding what is currently considered safe  
>> by a factor of four with no additional cost to you" I think many  
>> otherwise uninformed zone administrators are conditioned to choose  
>> the latter.
>
> ...which a good reason why we give actual numbers in this draft.
>
> I don't see where you are going with this.

Yeah, sorry for being vague.

> Do you want us to give hard numbers and not justify them so admins  
> won't pick anything else?

The advice in the document seems fine. I wonder whether it is complete.

If there's an expectation that people will choose bigger keys because  
they can, and that there are operational reasons why this would be  
bad, it seems sensible to explain those reasons as additional  
incentive for people not to do it. I don't think the current text  
really identifies those reasons very clearly.

But really I was more concerned that it wasn't obvious what those  
operational reasons might be.


Joe