Subject: Opt-in

From: Ben Laurie <[email-masked]>
Date: Tue, 16 Aug 2005 15:24:26 +0100

I've been reviewing the security considersations of 
http://www.ietf.org/internet-drafts/draft-ietf-dnsext-dnssec-opt-in-07.txt. 
It seems to me that the statement:

    In particular, this means that a malicious entity may be able to
    insert or delete records with unsigned names.  These records are
    normally NS records, but this also includes signed wildcard
    expansions (while the wildcard record itself is signed, its expanded
    name is an unsigned name).

This seems to me to be incorrect, since a denial of a domain must 
include a denial for the matching wildcard. Similarly, the wildcard 
being signed means that "insertion" isn't possible if there's a wildcard 
present, since all records would exist anyway.

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>