Subject: Re: Proposal to fix NSEC

From: Ben Laurie <[email-masked]>
Date: Tue, 01 Jun 2004 16:56:22 +0100

Chris Thompson wrote:

> [email-masked] (Ben Laurie) writes:
> [...]
> 
>>I actually am still of the view that if nameservers suddenly started 
>>returning NSEC2 instead of NSEC things would work as desired: namely old 
>>resolvers would suddenly get protocol errors instead of NXDOMAIN, and 
>>new resolvers would just work.
>>
>>If this causes bad things to happen, then DNSSECbis is already broken, 
>>since an attacker can clearly cause NSEC records to be corrupt.
> 
> 
> Define "bad". DNSSEC has never been proof against DoS attacks that make 
> it unable to answer questions (as opposed to answer them incorrectly).
> That doesn't mean that a protocol change that would simulate the effect
> of a DoS attack would be a desirable thing to advocate.

I certainly agree that if we could do better, we should.

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>