Subject: comments on draft-ietf-dnsext-dnssec-intro-08

From: David Blacka <[email-masked]>
Date: Fri, 9 Jan 2004 16:54:24 -0500

These are some relatively minor comments on the intro-08 document.

1 -- Section 6 ends by describing a "security-aware stub resolver" that
does its own signature validation.  I am wondering if there should
there be an explicit term for this? "Validating sub resolver" perhaps?

I only bring this up because I know that some folks that I have talked
to in the past wish that this sort of animal were the norm, and I know
that this sort of concept sometimes comes up when discussion the CD
bit.  This would be a term to essentially distinguish between a
security aware resolver which does recursion (or iterates) and one
that does not.

2 -- Section 11, 6th paragraph ends with: 

   While not an attack on the DNS
   itself, this could allow an attacker to map network hosts or other
   resources by enumerating the contents of a zone. There are non-DNS
   protocol means of limiting this attack such as limiting the number of
   NSEC queries from a single host, use of intrusion detection tools,
   etc.

This second sentence is not, technically, correct.  Limiting "NSEC" queries 
is not nearly good enough.  You would have to limit queries for any 
non-existant RR type.  For at least some of the organizations that are 
concerned about NSEC walking, rate limiting of any sort could be seen as a 
very bad idea.  I have no idea how intrusion detection tools could be used 
to mitigate NSEC walking, but that could just be my lack of familiarity 
with such tools.  I recommend that this latter sentence be just dropped.

-- 
David Blacka    <[email-masked]> 
Sr. Engineer    Verisign Applied Research

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>