Subject: Re: [dnsext] draft:draft-crocker-dnssec-algo-signal-06

From: "Rose, Scott W." <[email-masked]>
Date: Fri, 3 Sep 2010 08:33:05 -0400

That was actually in earlier versions of the draft (and the original purpose), but was rejected by the working group.  It would significantly complicate the resolution process, especially for caching middleboxes.  

Plus there is a potential downgrade attack where a man-in-the-middle attacker alters the algorithm list in a client's query that could lead to a denial of service.  It would be hard to do, but it's possible I guess.

Scott

On Sep 3, 2010, at 4:36 AM, Jiankang YAO wrote:

> Dear Steve and Scott,
>  
>  
>  
>    just looking throug your draft draft-crocker-dnssec-algo-signal-06,
>  
> since the resolvers signal the servers which algorithm the resovers support,
>  
> could the servers only return the RRSIGs that the resolvers support?
>  
> for example,
> the server has:
>           a.example A 192.168.1.1
>           a.example rrsig  the-signature-with-A-algorithm
>           a.example rrsig  the-signature-with-B-algorithm
>           a.example rrsig  the-signature-with-C-algorithm
>           a.example rrsig  the-signature-with-D-algorithm
>  
> now the resolver signal to tell the server that it support C algorithm.
>  
> so the server will return the following only:
>  
>   
>           a.example A 192.168.1.1
>           a.example rrsig  the-signature-with-C-algorithm
>          
>  
> instead of:
>  
>  
>           a.example A 192.168.1.1
>           a.example rrsig  the-signature-with-A-algorithm
>           a.example rrsig  the-signature-with-B-algorithm
>           a.example rrsig  the-signature-with-C-algorithm
>           a.example rrsig  the-signature-with-D-algorithm
>  
>  
> if this funtion is not the current feature, it will be bonus to your draft since it will reduce the dns response package.
>  
>  
> Jiankang Yao
> 
> 

===================================
Scott Rose
NIST
[email-masked]
+1 301-975-8439
Google Voice: +1 571-249-3671
http://www.dnsops.gov/
===================================