Subject: RE: dictionary attack on nameservers

From: Alex Bligh <[email-masked]>
Date: Sat, 07 Aug 2004 10:54:10 +0100

--On 06 August 2004 12:35 -0700 "Hallam-Baker, Phillip" 
<[email-masked]> wrote:

> The issue that concerns ME is not signing .com as signing
> verisign.com.

If there is an enterprise requirement for non-enumerability it would
be useful if this was more widely understood as this has previously
been seen as an issue for (some) TLDs.

Alex

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Ben Laurie <[email-masked]>
Date: Fri, 13 Aug 2004 12:03:47 +0100

Hallam-Baker, Phillip wrote:
>>From: [email-masked]
>>[mailto:[email-masked]]On Behalf Of Ben Laurie
>>Peter Koch wrote:
>>
>>>Miek Gieben <[email-masked]> wrote:
>>>
>>>
>>>
>>>>The main point of my post is that I can enumerate (for +/- 
>>
>>90%) a zone
>>
>>>>in 24 hours, even if AXFR is blocked. 
>>>
>>>
>>>thanks for this effort, hard data is a Good Thing.
>>
>>It is, but this is not hard data.
> 
> 
> Actually Ben, it would appear that it is hard data, a dictionary of 
> the 220,000 most common words in the English and Dutch languages 
> only has 5% effectiveness. I would have expected a much higher
> success rate. This data is hard evidence that a dictionary attack is
> not a serious risk. 

That is, indeed, hard data - but it is not what I was responding to.

-- 
http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff