Subject: RE: WG Last Call: DNSSEC bis documents

From: [email-masked] (Ted Lindgreen)
Date: Wed, 19 May 2004 10:45:43 +0200

[Quoting Marcos Sanz/Denic, on May 19, 10:39, in "RE: WG Last Call: DN ..."]
> > There _are_ implementations to reduce the (privacy-) problems that
> > are aggrevated by zone walking, 
> 
> Then I am sorry for divulging FUD. Can somebody send a pointer to these 
> existing solutions?

You must have missed my answer to you directly, so I'll repeat it
on the list.

--- Forwarded mail from [email-masked] (Ted Lindgreen)

>From [email-masked] Wed May 19 10:41:29 2004
Date: Wed, 19 May 2004 10:41:27 +0200
In-Reply-To: "Marcos Sanz/Denic's message as of May 19, 10:19"
To: Marcos Sanz/Denic <[email-masked]>, [email-masked] (Ted Lindgreen)
Subject: RE: WG Last Call: DNSSEC bis documents

[Quoting Marcos Sanz/Denic, on May 19, 10:19, in "RE: WG Last Call: DN ..."]
> > There _are_ implementations to reduce the (privacy-) problems that
> > are aggrevated by zone walking, 
> 
> Excuse my ignorance, Ted: can you send me a pointer? I haven't read about 
> that anytime in namedroppers.

Probably right: I don't think it is a protocol issue anyway.

As for a pointer, see f.i. the presentation from Bart Boswinkel
(CEO of SIDN/.nl) in:
 http://www.sdl.sri.com/other/dnssec/DNSSEC04MayNL-Info.html

As for work done: the main problem is that zonewalking facilitates
extracting whois info (zonewalking as such can not be expected to
have big legal implications, as DNS-info is intentionally made
public; however, whois-info is sensitive in terms of the European
privacy legislation, therefore the combination is dangerous).

SIDN has put significant effort to make the internet community
(in the broad sense) aware of the problem and to work to consensus
how to deal with it.

Regards,
-- ted

--- End of forwarded message from [email-masked] (Ted Lindgreen)

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Marcos Sanz/Denic <[email-masked]>
Date: Wed, 19 May 2004 11:04:23 +0200

Ted,

> http://www.sdl.sri.com/other/dnssec/DNSSEC04MayNL-Info.html

The presentation is interesting, but I couldn't find any existing 
technical solution to the NSEC traversal problem there. This was what I 
was looking for when I asked for a pointer of "non-DNS protocol means of 
detecting and limitting this attack".

> extracting whois info

If there is a problem with whois, whois should be fixed. I personally 
agree with you. But the problem is "a zone can be traversed" and the 
policy of many registries doesn't allow zone transfer. There, I was 
looking for a solution.

> (in the broad sense) aware of the problem and to work to consensus

No criticism at all on SIDN's work.

I am for dropping the sentence.

Regards,
Marcos