Subject: Zone enumeration, requirements, and security redux

From: "Loomis, Rip" <[email-masked]>
Date: Thu, 2 Sep 2004 09:57:28 -0400

Previously, on 11 August, I sent a message to the list
which can be seen at
  http://ops.ietf.org/lists/namedroppers/namedroppers.2004/msg01465.html

Based on Olaf's last e-mail I wanted to summarize that
message and talk about some other related issues (such
as getting one agreed-upon definition for "security by
obscurity") but I couldn't fit the full argument into
20 lines.  I also wanted to make one last call for
desirements and requirements related to NSEC/zone
enumeration/etc--so that Ben and I can get a next draft
of the collected requirements out for review and
prioritization.

Bottom line--I believe that a replacement for NSEC
that does not provide for easy zone enumeration is
both worthwhile (will make it easier to address both
privacy and security concerns that DNS users will
have) and realistic.  I further believe that it *should*
be possible to find a replacement for NSEC in parallel
with an initial roll-out of DNSSECbis to several
major zone.

I only wish I'd whined more about NXT zone walking back
in 1999, when I first decided that it might be a
real stumbling block for DNSSEC acceptance.

Comments on the above, and *any last requirements*
requested.

  --Rip    (And yes, I *still* went over 20 lines.)

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>