Michael and Mukund, Thank you for the careful reads. -03 is now posted and picks up the Appendix C comment. We also added Section 7.3, which describes an optional signed-ladder cache, so a client doesn't need to revalidate a ladder it has already seen.
-Swapneel On 10/1/26, 5:35 PM, "Michael Richardson" <[email protected] <mailto:[email protected]>> wrote: Mukund Sivaraman <[email protected] <mailto:[email protected]>> wrote: > It's a clever construction and impressive. :) But I shudder at the added > complexity of implementing this compared to the relative simplicity of > Bas Westerbaan's draft. Having finished reading, I agree. I think that Appendix C is kinda incorrect: I think that verifiers likely would do the steps in the opposite direction, causing cache misses if the previous steps haven't already been done yet. I think that this avoids doing so much work when the response data has been corrupted by an on-path attacker. -- Michael Richardson <[email protected] <mailto:[email protected]>> . o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide ** My working hours and your working hours may be different. ** ** Please do not feel obligated to reply outside your normal working hours ** _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
