NSEC3 issue: DNSSEC is too complex by half already

[bert hubert <bert.hubert@netherlabs.nl>]

Geoff,

Partially in jest, but please consider adding this issue:

DNSSEC is too complex by half already
-------------------------------------

DNS is not a simple protocol. DNSSEC adds a degree of authentication and
integrity to DNS but at a vast cost: attempting to maintain the DNS packet
format and benefits of existing infrastructure has made the DNSSEC design a
triumph of cleverness and complexity.

NSEC3, introduced to add a modicum of privacy to zones, adds a further 42
pages of specifications.

NSEC3 might very well break the camel's back - insofar as it was intact up
to now.

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://netherlabs.nl              Open and Closed source services

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>