Subject: I-D Action: draft-fujiwara-dnsop-fragment-attack-01.txt

From: [email-masked]
Date: Fri, 01 Mar 2019 04:07:08 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.

        Title           : Measures against cache poisoning attacks using IP fragmentation in DNS
        Author          : Kazunori Fujiwara
	Filename        : draft-fujiwara-dnsop-fragment-attack-01.txt
	Pages           : 13
	Date            : 2019-03-01

Abstract:
   Researchers proposed practical DNS cache poisoning attacks using IP
   fragmentation.  This document shows feasible and adequate measures at
   full-service resolvers and authoritative servers against these
   attacks.  To protect resolvers from these attacks, avoid
   fragmentation (limit requestor's UDP payload size to 1220/1232), drop
   fragmented UDP DNS responses and use TCP at resolver side.  To make a
   domain name robust against these attacks, limit EDNS0 Responder's
   maximum payload size to 1220, set DONTFRAG option to DNS response
   packets and use good random fragmentation ID at authoritative server
   side.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-fujiwara-dnsop-fragment-attack/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-fujiwara-dnsop-fragment-attack-01
https://datatracker.ietf.org/doc/html/draft-fujiwara-dnsop-fragment-attack-01

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-fujiwara-dnsop-fragment-attack-01

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/