Subject: NSEC3 Issue 21: Signer behavior in case of hash collision.

From: Roy Arends <[email-masked]>
Date: Wed, 31 May 2006 18:05:12 +0200

Issue:

Signer behavior in case of hash collision.

Discussion:

If there exists a name and a wildcard record where the corresponding hash 
values collide, an attacker can replace a positive answer with a wildcard 
and vice versa. Though hash functions are designed to be collision 
resistant, the question has been raised if signers are allowed to, or 
should check. 

Resolution:

The editors will add a note to the draft that a collision resistant hash 
function MUST be used, and that zone-signers are allowed to detect hash 
collisions.

The editors see this as a non-issue and regard it as closed.

Regards,

Roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>