<html><head>
<meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type">
</head><body bgcolor="#FFFFFF" text="#000000"><br>
<br>
<blockquote style="border: 0px none;"
cite="mid:6F97FCC6-59E8-47CC-A520-96B0984D0CD1@conundrum.com"
type="cite">
<div style="margin:30px 25px 10px 25px;" class="__pbConvHr"><div
style="display:table;width:100%;border-top:1px solid
#EDEEF0;padding-top:5px"> <div
style="display:table-cell;vertical-align:middle;padding-right:6px;"><img
photoaddress="matt@conundrum.com" photoname="Matthew Pounsett"
src="cid:part1.03090001.01000607@redbarn.org"
name="compose-unknown-contact.jpg" height="25px" width="25px"></div> <div
style="display:table-cell;white-space:nowrap;vertical-align:middle;width:100%">
<a moz-do-not-send="true" href="mailto:matt@conundrum.com"
style="color:#737F92
!important;padding-right:6px;font-weight:bold;text-decoration:none
!important;">Matthew Pounsett</a></div> <div
style="display:table-cell;white-space:nowrap;vertical-align:middle;">
<font color="#9FA2A5"><span style="padding-left:6px">Saturday,
November 29, 2014 12:56 PM</span></font></div></div></div>
<div style="color:#888888;margin-left:24px;margin-right:24px;"
__pbrmquotes="true" class="__pbConvBody"><div><!----><br>People move
zone data around using mechanisms other than *XFR (scp, database
replication, etc.). A signature on the complete zone, as part of the
zone, also covers those mechanisms.</div></div>
</blockquote>
<br>
can you tell me the use case for having this signature be in-band? that
is, i know that detached signatures like pgp or detached strong hashes
like md5 can be used to verify zone content in an out-of-band transfer
(not using *XFR, as you describe.) you're intimating a need for an
in-band signature so that the local secondary server can know, when
loading the zone, that the zone is complete. since some extant
out-of-band transfer methods (copying an mmap file, or updating an HA
database) do not require that the secondary server fully read the zone
before they begin serving that zone, it strikes me that for zones
containing tens or hundreds of millions of records, adding per-zone
signature would imply such a high burden for these sparse-access
secondary implementations (that is, we didn't have to read the whole
zone to verify the signature before, but, now that there's a zone
signature to be verified, we have to read the whole thing and verify the
signature before we can start serving it) that it would not be used.<br>
<br>
my supposition has always been that if you're using an out-of-band
transport (not IXFR/AXFR) to move zones around, then your out-of-band
transport will do its own signing and verification.<br>
<br>
let me please note for the record that i long for a secure hash of zone
content, but i don't know how to create one that can be updated (when an
UPDATE is received at the primary server or an IXFR is received at the
secondary server) and still have that hash be secure.<br>
<br>
<div class="moz-signature">-- <br>Paul Vixie<br>
</div>
</body></html>