Subject: Re: DNS Blackhole attack

From: Paul Vixie <[email-masked]>
Date: Sun, 06 Mar 2005 16:28:37 +0000

> >   (2) Attacks which exploit weaknesses in resolver implementations
> >   which fail to discard bogus data received from authoritative name
> >   servers they have queried.
> 
> Actually, attacks can exploit weaknesses in resolver implementations
> which fail to distinguish and to separately cache unauthoritative
> (delegation) data received from authoritative name servers they have
> queried.

both of those statements are true.

> DNSSEC can't be helpful, unless parent zones sign glues, which
> causes serious management troubles.

this statement, however, is not.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Ralph Droms <[email-masked]>
Date: Sun, 06 Mar 2005 13:42:44 -0500

Paul - which part (or all) of "DNSSEC can't be helpful, unless parent zones
sign glues, which causes serious management troubles." isn't true?

- Ralph

---

From: Pekka Savola <[email-masked]>
Date: Sun, 6 Mar 2005 20:58:42 +0200 (EET)

> both of those statements are true.

maybe this calls for working on specifying more clearly what resolvers 
(and other DNS components) must and must not do?

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Masataka Ohta <[email-masked]>
Date: Mon, 14 Mar 2005 18:30:49 +0900

> this statement, however, is not.

My apologies.

DNSSEC can't be helpful, even if  parent zones sign glues.

Sloppy DNSSEC implementations do not distinguish glue As signed by
their parent zones and As signed by authorities, just as sloppy DNS
implementations do not distinguish glue As supplied by their parent
zones and As signed by authorities.

							Masataka Ohta