Re: [DNSOP] rfc4641bis: NSEC vs NSEC3.

Olafur Gudmundsson <ogud@ogud.com> Sun, 21 February 2010 00:25 UTC

Return-Path: <ogud@ogud.com>
X-Original-To: dnsop@core3.amsl.com
Delivered-To: dnsop@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D073A3A829C for <dnsop@core3.amsl.com>; Sat, 20 Feb 2010 16:25:05 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.48
X-Spam-Level:
X-Spam-Status: No, score=-2.48 tagged_above=-999 required=5 tests=[AWL=0.119, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w01722970Tgh for <dnsop@core3.amsl.com>; Sat, 20 Feb 2010 16:25:05 -0800 (PST)
Received: from stora.ogud.com (stora.ogud.com [66.92.146.20]) by core3.amsl.com (Postfix) with ESMTP id 9534E3A829A for <dnsop@ietf.org>; Sat, 20 Feb 2010 16:25:04 -0800 (PST)
Received: from [IPv6:::1] (nyttbox.md.ogud.com [10.20.30.4]) by stora.ogud.com (8.14.3/8.14.3) with ESMTP id o1L0Qeqo047911; Sat, 20 Feb 2010 19:26:41 -0500 (EST) (envelope-from ogud@ogud.com)
Message-ID: <4B807DC0.9050807@ogud.com>
Date: Sat, 20 Feb 2010 19:26:40 -0500
From: Olafur Gudmundsson <ogud@ogud.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-GB; rv:1.9.1.7) Gecko/20100111 Thunderbird/3.0.1
MIME-Version: 1.0
To: Evan Hunt <each@isc.org>
References: <200904282021.n3SKL3sg051528@givry.fdupont.fr> <59A58419-FDBD-4810-B2FA-0D293FFA00A5@NLnetLabs.nl> <alpine.LFD.1.10.1001211245180.12114@newtla.xelerance.com> <1AEAE091-2EB3-41DC-A51B-8DD49C10FAD5@NLnetLabs.nl> <24C8A8E2A81760E31D4CDE4A@Ximines.local> <8E6C64ED-A336-4E8B-996F-9FB471EB07C6@NLnetLabs.nl> <4B7FE58C.5030605@ogud.com> <20100220202751.GB54720@shinkuro.com> <20100220213133.GE2477@isc.org>
In-Reply-To: <20100220213133.GE2477@isc.org>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
X-Scanned-By: MIMEDefang 2.67 on 10.20.30.4
Cc: Andrew Sullivan <ajs@shinkuro.com>, Olaf Kolkman <olaf@NLnetLabs.nl>, dnsop WG <dnsop@ietf.org>, Alex Bligh <alex@alex.org.uk>
Subject: Re: [DNSOP] rfc4641bis: NSEC vs NSEC3.
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsop>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 21 Feb 2010 00:25:06 -0000

Thanks Evan and Andrew fot translating my thoughts into better prose.
Evan, you captures my meaning.

	Olafur


On 20/02/2010 4:31 PM, Evan Hunt wrote:
>
>> I think Olafur's point is a good one, but I'm unhappy with the prose.
>> Some suggested changes below.
>
> Same here.
>
> Nits:
>
>> There are to mechanisms to provide authenticated proof of
>
> s/to/two/
>
>> Each mechanism includes a list of all the RRTYPEs present at the
>
> s/includes/stores/
>
>>> The clear text version has its one RRtype for negative answer, Clear
>>> text one uses NSEC record and the obfuscated one used NSEC3.
>>
>> I didn't know how to rephrase that, because if I understand it I think
>> what I understand is wrong (but that's obviously not the case, so
>> probably I don't understand it).
>
> I think he meant "each version has its own RRtype".  Suggested change:
>
> "Each mechanism uses a specific RRTYPE to store information about the
> RRTYPEs present at the name: the clear-text mechanism uses NSEC, and
> the obfuscated-data mechanism uses NSEC3."
>
> It may also be worth mentioning that the two mechanisms are usually
> referred to by the names of their corresponding RR types.
>
> --
> Evan Hunt -- each@isc.org
> Internet Systems Consortium, Inc.
>
>
>