Subject: the dictionary attack thread

From: Edward Lewis <[email-masked]>
Date: Mon, 30 Aug 2004 14:06:56 -0400

I have spoken against this thread a few times already.  Not against 
either "side" of the debate, but against the thought that this is a 
useful thread.  It's educational, but my point is, "so what."

My position is that "if someone wants to drive a solution to the 
question 'how do we provide authenticated denial without exposing 
other information' so be it.  More power to them."  In fact, I admit 
I'd like to see a solution. (But first requirements![0].)

Dan Bernstein said:
>A good security protocol would allow signing the nonexistence of some
>selected names without revealing anything about other names.

He hit the nail on the head there.  That's a good requirement to put 
into the document on this.  I'm not saying NSEC is a bad protocol, 
but it's at best an acceptable one to many of the participants of the 
WG.  It even has passed the test of "consensus."

Those who postulate that they will never run DNSSEC with NSEC's zone 
enumeration have every right to avoid deploying what's in the 
DNSSECbis documents.  There are legitimate reasons to have objections 
to zone enumeration, stemming from local operating conditions.  In 
"arguing" over the reasons, let's keep in mind that this is a list on 
the DNS protocol, not registry operations.  Let's not get into the 
details of how to defend zone enumeration within DNS, let's just 
stick to deciding that if someone has a new solution to the problem - 
whether the problem is "good" or at least better than what we have 
now.

I don't think that anyone against (say) NSEC has ever thrown up a 
road block to the DNSSECbis documents.  Comments against, sure, 
commentary is always permitted, even if it may not be seen as 
welcomed.  Commentary is an essential element in producing refereed 
engineering documents.

My pointing this out is because I am somewhat surprised that there is 
a strong resistance by some to "permit" the search for a solution 
that does not have zone enumeration.  If you are of the camp that 
thinks NSEC is the best solution out there (maybe rightfully so, I am 
not challenging that), to quote some wise sage of the IETF, "let a 
thousand flowers bloom."

[0] - Yes, wild card clarify ... yea, yea...
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

"I can't go to Miami.  I'm expecting calls from telemarketers." -
Grandpa Simpson.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>