Subject: Re: issues with draft-ietf-dnsext-dnssec-trans-00.txt

From: Greg Hudson <[email-masked]>
Date: Mon, 14 Jun 2004 20:37:19 -0400

On Mon, 2004-06-14 at 16:57, Paul Vixie wrote:
> if you want non-authenticated denial, maybe you should just leave out
> the NSEC altogether.

I think at that point you may as well not answer the question.  If your
zone has a key, an unsigned response looks like an attack, and should be
discarded.

I kind of like the deny-the-whole-zone NSEC response, personally.  The
denial replay attack seems like a relatively mild practical
consequence.  (Of course, I think it's much better to have real NSEC
records and a zone file available for FTP, and I think most of the
arguments against doing that are horribly off the mark, but I'm willing
to take it as axiomatic that some zones will find denying enumeration
more important than having good security against spoofing attacks.)

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Ben Laurie <[email-masked]>
Date: Tue, 15 Jun 2004 13:02:46 +0100

Paul Vixie wrote:

>>>if you do nothing, then paranoid clients will continue to have very
>>>little confidence in spoofed data.  if you use a zone-covering NSEC
>>>for all responses, then paranoid clients will have high confidence
>>>in spoofed data.
>>
>>Which is one reason why it would be good if there was some signaling
>>that denials should not be treated as authenticated: ...
> 
> 
> the NSEC altogether.  putting your signature on one that covers names
> which actually exist, and then leaking that signed "lie" to the universe,
> where others could replay or misinterpret it out of context, seems like
> a huge mistake to me.

This would work for me - but will resolvers be happy with such a response?

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff