Subject: Zone enumeration, requirements, and security

From: "Loomis, Rip" <[email-masked]>
Date: Wed, 11 Aug 2004 15:59:21 -0400

First, although nothing on-list has really convinced me that
zone enumeration is a security issue, I was convinced
off-list that it *is*.  In a postulated future (hopefully
not too far-fetched) world, zone enumeration could
definitely help an attacker to find IPv6-aware targets
given the lower expected density of IPv6 nodes.  (This
assumes that either reverse-lookup records are not
configured for an IPv6 zone, or that they are configured
but not useful in target selection--and is separate
from the concerns of delegation-centric zones which
I believe are still privacy/licensing related rather
than truly security relevant.)   The biggest reason why
DNS is a minor input to the current target selection
process for attackers is that it's already a target-
rich environment--and IPv6 may be expected to shift
that balance.

Secondly, I do believe I understand the concern with
zone enumeration making it easy for an attacker to
collect RRs.  I'm still not convinced that having those
RRs revealed is a security concern, but I'll accept that
preventing zone enumeration will reduce risk by some
amount (however small) *and* that allowing zone enumeration
is a change to an expected/current behavior of DNS
(which can be considered as designed-in even though
it was not required by any protocol spec).  This is,
I believe, the argument being made by Dr. Phill
Hallam-Baker.

So although the existence of a capability for zone
enumeration does not directly make systems more vulnerable,
it does increase the probability of a successful
attack.  As a result I now believe we have at least one
and probably two separate bases for a security requirement:
Restricting the ability of attackers to enumerate zones
produces a security benefit.

Could anyone out there who disagrees please clearly
(re-)state their disagreement and basis for it?  If
no one does then we'll try to reflect those concerns
as best we can.

And could anyone with any remaining requirements related
to zone enumeration, NSEC, and any *other* thing they
don't like about DNSSEC please state them now?  (yeah,
I still want an effective means of key revocation but
I don't see it happening at this rate--and it's outside
the scope of my little piece right now.)  As soon as my
co-editor and I can synch back up I'd really like to get
an updated draft of the requirements collection doc out
for WG review so that we can all move forward into the
verification and prioritization of requirements.

  --Rip

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>