Subject: [dnsext] Re: Anti DNS spoofing - Extended Query ID (XQID)

From: Florian Weimer <[email-masked]>
Date: Wed, 10 Sep 2008 14:04:31 +0200

By the way, it just occurred to me that all these approaches based on
adding stuff to the QNAME share a fundamental issue: What do you do if
adding the stuff pushes the QNAME beyond the 255 byte limit?

(I don't know if this observation is original, but I think it's a
reason why these approaches are doomed.)

-- 
Florian Weimer                <[email-masked]>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: +49-721-96201-1
D-76133 Karlsruhe             fax: +49-721-96201-99

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Nicholas Weaver <[email-masked]>
Date: Wed, 10 Sep 2008 05:40:45 -0700

> reason why these approaches are doomed.)

Not really.  Even without 0x20, stuff added in the query thats random  
is 5b of entropy each character.

OTOH, I don't think its needed because duplication is an easier way to  
gain a lot of entropy quickly, and you can have a fallback on that for  
the few volatile authorities.

---

From: Alex Bligh <[email-masked]>
Date: Wed, 10 Sep 2008 16:41:50 +0100

> adding the stuff pushes the QNAME beyond the 255 byte limit?

I observed a while ago that this potential problem had, to a degree,
been covered in the NSEC3 debate which presents similar issues due to
label length.

Alex