Subject: Re: comments on nsec3-01

From: Paul Vixie <[email-masked]>
Date: Thu, 03 Mar 2005 21:27:06 +0000

> > No, that's not what I'm saying. I'm saying that those who want NSEC3
> > _will not deploy_ with NSEC, so what you get _is_ classis DNS unless you
> > deploy NSEC3.
> 
> Whilst I agree with your argument in general, the foregoing is actually an
> exaggeration. Yes, a large constituency of those who want NSEC3 will not
> deploy with NSEC. However, there are others for whom NSEC3 is desirable ...
> 
> So while Olaf has Paul saying:
> > If you deploy today, the introduction of new features should not
> > make you vulnarable if you choose not to upgrade and use the new
> > feature.
> 
> that's a reasonable requirement if by "use the new feature" you mean
> "use NSEC3 not NSEC" provided you also add "and do not deliberately
> use options that arguably make you more vulnerable" (e.g. opt-in).

and yet, none of these takes account of what i meant by dnssec-of-the-month.

every time we roll the hash algo for NSEC3, the problem recurs.

if it was just that adding NSEC3 made zones less secure while validators
were yet to upgrade, then there'd be a flag day.

we're talking about a flag-tuesday.  every tuesday from now on.  is that ok?

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Sun, 06 Mar 2005 23:15:56 +0000

> > the case where the glue is MIM'd reduces to the case where your
> > packets are destroyed by loss or congestion,
> 
> For my education: Why does an attack which involves *introducing* a
> spurious glue record (in vanilla DNS) reduce (in DNSSEC) to an attack
> where packets are destroyed by loss or congestion (which I agree in
> DNSSEC is insoluble)?

it you contact an address which was introduced to you as an authority for
some zone, and it can't answer with a key corresponding to that zone's DS
in the parent zone, then you'll be throwing their answers away, which is
exactly the same in dnssec terms as never having received those answers,
which is exactly what would happen if they never hear your questions.