Subject: [dnsext] Err, CORRECT link for my comments...

From: Nicholas Weaver <[email-masked]>
Date: Tue, 30 Sep 2008 11:13:33 -0700

The previous version had an error in the xml that resulted in an  
improper naming.

The proper name and link:

http://www.ietf.org/internet-drafts/draft-weaver-dnsext-comprehensive-resolver-00.txt

Again, abstract

    DNS resolvers are vulnerable to many attacks on their network
    communication, ranging from blind attacks to full men-in-the-middle.
    Although a full man-in-the-middle can only be countered with
    cryptography, there are many layers of defenses which apply to less
    powerful attackers.  Of particular interest are defenses which only
    require changing the DNS resolvers, not the authoritative servers or
    the DNS protocols.  This document begins with a taxonomy of attacker
    capabilities and desires, and then discusses defenses against  
classes
    of attackers, including detecting non-disruptive attacks, entropy
    budgeting, detecting entropy stripping, semantics of duplication,  
and
    cache policies to eliminate "race-until-win" conditions.  Proposed
    defenses were evaluated with traces of network behavior.

Comments are greatly appreciated.  Many thanks.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>