[dns-operations] Some DNSSEC trivia

[Florian Weimer]

* Edward Lewis:

> For zones, yes, but in older BIND versions it didn't use the 
> red-black tree for the contents of zones.  Back in the day it used a 
> hash table for the contents of zones.  The has table had to be 
> removed in favor of a tree to accommodate DNSSEC, one of the 
> "improvements" needed by DNSSEC that caused BIND 9 to come into 
> being.  Remember when BIND 9 was considered to be slower than BIND 8? 
> If I learned corretly, that was a symptom of the change from a hash 
> table to a tree.

RB-trees are also better at yielding consistent performance
independently of the key distribution.  Just imagine what happens to
your server when you load an update for a zone which happens to
trigger tons of hash collisions. 8-)

(Typically, these hash tables aren't implemented with
cryptographically strong hashes, so this is often feasible.)

-- 
Florian Weimer                <fweimer at bfk.de>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: +49-721-96201-1
D-76133 Karlsruhe             fax: +49-721-96201-99