Subject: Re: dictionary attack on nameservers

From: David Blacka <[email-masked]>
Date: Tue, 17 Aug 2004 10:57:54 -0400

On Tuesday 17 August 2004 4:45 am, Jim Reid wrote:

> To get things back on-track, the WG needs to answer these two
> questions:
>
> [1] Does the inevitability of NSEC walking create technical or
> protocol problems? [Sure, it creates a deployment problem for some
> TLDs but for policy, not technical, reasons.]

I disagree.  I think the WG has answered this question: No.  This is why we 
advanced the DNSSECbis documents.

The real question here is: Does the NSEC walking issue create a significant 
deployment problem?  Granted, this question is much harder to answer.

> [2] Is it worth the time and effort to "fix" NSEC walking -- and no
> doubt hold up the deployment of a Secure DNS for maybe another 5 years
> -- when this issue only creates *policy* difficulties for a small
> number of admittedly very significant corner cases?

Whose time and effort?  Yours?  No one can force you to work on the problem.

But the way the question is phrased make me wonder if the causality is 
backwards.  The question says that working on the zone enumeration will hold 
up DNSSEC deployment.  Maybe, instead, people want to work on the problem 
because the problem will hold up DNSSEC deployment.

> IMO the answer to both questions is no.
>
> It would also be interesting to find out from the owners of domain
> names in .de and .uk what they'd prefer: securing the DNS for their
> zones or preventing Bad People from generating a copy of the TLD.

Don't we know this answer, too?  Clearly, they would rather not make that 
choice, but what I hear co.uk saying is that for now they would prefer to 
prevent zone enumeration.  Not solving this problem makes everyone make this 
choice.

-- 
David Blacka    <[email-masked]> 
Sr. Engineer    VeriSign Applied Research

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Alex Bligh <[email-masked]>
Date: Tue, 17 Aug 2004 19:20:04 +0100

> Whose time and effort?  Yours?  No one can force you to work on the

Not only that, but we (Nominet) have offered contributions / funding to fix
it. The point is we /want/ to see it deployed and are prepared to help
make it deployable (according to our definition of deployable). I do
not see how working to solve zone enumeration is going to delay
deployability, as if those who think it isn't a problem are correct (and
we are wrong), then it will get deployed notwithstanding our views.

Alex