Subject: dns-threats, DNSSEC, and glue

From: Rob Austein <[email-masked]>
Date: Mon, 16 Feb 2004 06:15:23 -0500

<hat dnssec-editor=off just-another-bozo-on-this-bus=on>

Two separate reviewers of draft-ietf-dnsext-dns-threats have raised
essentially the same question over the following paragraph:

   DNSSEC signatures do not cover glue records, so there's still a
   possibility of a name-based attack involving glue, but with DNSSEC it
   is possible to detect the attack by temporarily accepting the glue in
   order to fetch the signed authoritative version of the same data,
   then checking the signatures on the authoritative version.

Both reviewers asked, in essence, "does that mean that a
security-aware resolver -will- use this defense?"

The DNSSECbis drafts are silent on this issue.  Should they say
something about this?

</hat>

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>