Subject: was Re: Avoiding collisions

From: Edward Lewis <[email-masked]>
Date: Fri, 17 Sep 2004 20:10:39 -0400

At 8:04 +1000 9/18/04, Mark Andrews wrote:
>>  OTOH, even if you define a hash mess to avoid collisions at signing
>>  time, you can't guarantee against a query name's hash clash.
>
>	Thank you Ed.  You at least are repeating (if not hearing)
>	what I have been saying.

Well I think a lot of us are coming around to that reality now.  I 
realized it when I wrote the example - by accident.  I'm not saying I 
was the first to realize it - but that's when I realized it.

BTW - I have never been a fan of hash approaches, not even then they 
were first discussed in 99 or so.  To me there's a siren's call 
associated with them.  I guess I have been brainwashed into thinking 
zone enumeration is a given, but really I can understand why it's 
undesirable (to say the least).

So far just about all of the "complaining" (for lack of a better 
word) about zone enumeration seems to have come from large 
registries.  Question: is zone enumeration a more general "problem?"

I ask this because if zone enumeration is only a problem for large 
registries, can it be assumed that a solution that is heavy-handed be 
acceptable?  Saying "large" carries the assumption of well-funded, 
attendant operating staff, and with (machine) resources under one 
control.  "Heavy-handed" in the sense that it would take a 
considerable out-of-band effort to maintain.

Digging further, if the assumption can be made that the only 
organizations that will need to "defend" against zone enumeration are 
well-funded to do so, an approach like on-line signing appears to be 
a start to a solution.  (I'd call it heavy handed in the sense that 
key management is needed.)  A "start" - I want to emphasize that.

This is all premature still, I don't know if we've come to an 
understanding of the problem (requirements).  But all this talk about 
hashing and salt...
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

"I can't go to Miami.  I'm expecting calls from telemarketers." -
Grandpa Simpson.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Simon Josefsson <[email-masked]>
Date: Sun, 19 Sep 2004 12:57:01 +0200

> registries.  Question: is zone enumeration a more general "problem?"

Yes.  The risks in smaller zones further down in the domain tree are
different from the risks in zones higher up in the tree, but they do
exist.  The citation I like to give, on risks in smaller zones, is:

  Steven M. Bellovin, "Using the Domain Name System for System Break-Ins", in
  Proceedings of the Fifth Usenix UNIX Security Symposium, Salt Lake City, UT,
  June, 1995. http://www.research.att.com/~smb/papers/dnshack.pdf

> considerable out-of-band effort to maintain.

Without any details of what you are thinking of, it is difficult to
say.  Even todays DNSSEC require various out-of-band efforts to
maintain; for key exchanges, root key configuration, key rollover etc.
If it was on that magnitude, it isn't a problem, but if this is more
heavy-handed than that, I'm not so sure.

Thanks,
Simon