Subject: Re: dictionary attack on nameservers

From: "Olaf M. Kolkman" <[email-masked]>
Date: Wed, 8 Sep 2004 10:20:59 +0200

On Tue, 7 Sep 2004 22:57:30 +0100
Roy Badami <[email-masked]> wrote:
> However Olaf contacted me privately requesting

For the record this was my request:
 
 Hello,

 I am sending this message to a few people that where had an
 outspoken meaning in this discussion. With reference to 
 http://ops.ietf.org/lists/namedroppers/namedroppers.2004/msg01600.html
 would you mind giving a 20 lines conclusion of your arguments?

 Thanks,

 -- Olaf

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Miek Gieben <[email-masked]>
Date: Wed, 8 Sep 2004 11:55:46 +0200

Hello,

I could only manage to write 17 lines :-) But here is goes:

First of all, any solution to be found for the "problem" of enumeration is
a solution that will only work for 50% (as there are other ways of getting
the data). If think a protocol change is a big sacrifice for a non optimal
solution.

Secondly only a few TLD's have expressed their concern about this, which is,
IMO, again another reason not to fiddle with the protocol.

That said, I also take the view that enumeration in DNSSEC should not be made
easier than it is today. 

The requirements from Ed [1] are a good starting point. But as Ed said
- you will never have a solution that will satisfy all these
contraints.

[1]
http://ops.ietf.org/lists/namedroppers/namedroppers.2004/msg01610.html

grtz Miek

---

From: Jelte Jansen <[email-masked]>
Date: Wed, 08 Sep 2004 12:10:25 +0200

Okay, here's my 20 lines.

--start line count--
I think Lewis summed it up pretty well, and I don't see any way to 
satisfy all these constraints either, it would be great if someone else 
would. One of the biggest problems I have with all this is that DNS(SEC) 
is complicated enough as it is, and we should be really really really 
sure that it is a problem (...of DNS (...on the protocol level)), before 
we start adding yet more complexity to it all (which is a security risk 
itself).

For those who have problems with enumeration, online signing shall 
probably not be a solution either, but muddying up the namespace will 
not make administrating zones any easier. Insofar i have read the 
proposals I have serious doubts if they solve the enumeration problem, 
but that can probably be fixed, and I haven't given them much attention 
(see above).

The 5 requirements mentioned by Lewis should be at least present in the 
requirements documentation, be it as hard requirements or strong 
considerations, as the trade-off for any solution should be well considered.
-- line 20 --

Jelte