Subject: Re: Proposal to fix NSEC

From: [email-masked] (Geoffrey Sisson)
Date: Mon, 24 May 2004 12:37:43 +0100 (BST)

Paul Vixie <[email-masked]> writes:

> When the "NO RR" was evaluated by the dnsext working group, these opposing
> requirements were taken into account, and anti-enumeration lost out.  I had
> no dog in that race so this was only of academic interest to me -- "what 
> does BIND have to implement?" and "how can we get DNSSEC done in a decade?"
> where my only concerns.
> 
> If the WG made the wrong choice and if DNSSEC is unimplementable because TLD
> holders fear enumeration and so SLD holders will have secure path to the
> root zone, then it appears that there's really no choice except to declare
> failure.

Four years ago, when Simon's NO draft was considered by the WG, it
appeared entirely plausible that implementation-based rate limiting
mechanisms would be sufficent to offset any threat of elaboration.
With the subsequent increase of the
sophistication/size/duration/untraceablity/scope of such of distributed
abuse -- especially including zombie networks "for hire" -- we believe
this is no longer the case, and that protocol-level modifictions again
have to be considered by the WG as a possible "palliative" strategy.

The old anwer isn't the new answer, but I don't believe this the same
as declaring failure . . .

Regards

Geoff

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Mon, 24 May 2004 14:16:17 +0000

> mechanisms would be sufficent to offset any threat of elaboration.

wow.  that was the wrong view, both on the facts and on principle.

> ... we believe this is no longer the case, and that protocol-level
> modifictions again have to be considered by the WG as a possible
> "palliative" strategy.
> 

you're using different words than declaring failure, but if adopted,
this position would have the same result as declaring failure.  

nothing we can do in dns will ever prevent useful enumerations by bad 
people who will use the data to index your whois and spam your customers.