Subject: [dns-dir] DNS Early Warn: draft-weaver-dnsext-fr-comprehensive-00.txt

From: Olafur_DNS_EARLY_WARNING <[email-masked]>
Date: Fri, 7 Nov 2008 21:17:54 -0500

Count:       56 

DNS Extensions Working Group                                   N. Weaver
Internet-Draft                            International Computer Science
Intended status: Informational                                 Institute
Expires: April 3, 2009                                September 30, 2008

      Comprehensive DNS Resolver Defenses Against Cache Poisoning
                draft-weaver-dnsext-fr-comprehensive-00

 Abstract
   DNS resolvers are vulnerable to many attacks on their network
   communication, ranging from blind attacks to full men-in-the-middle.
   Although a full man-in-the-middle can only be countered with
   cryptography, there are many layers of defenses which apply to less
   powerful attackers.  Of particular interest are defenses which only
   require changing the DNS resolvers, not the authoritative servers or
   the DNS protocols.  This document begins with a taxonomy of attacker
   capabilities and desires, and then discusses defenses against classes
   of attackers, including detecting non-disruptive attacks, entropy
   budgeting, detecting entropy stripping, semantics of duplication, and
   cache policies to eliminate "race-until-win" conditions.  Proposed
   defenses were evaluated with traces of network behavior.

_______________________________________________
dns-dir mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dns-dir