Subject: RE: WG Last Call: DNSSEC bis documents

From: "Christian Huitema" <[email-masked]>
Date: Tue, 18 May 2004 13:21:01 -0700

>     >> Rate limiting and intelligent firewall filtering can reduce the
>     >> exposure to NSEC traversal. It should be fairly straightforward
>     >> to train a name server implementation to detect these attacks
>     >> too. Sure, these defences might not be much help against a
>     >> well-disguised attack. But they do provide some level of
>     >> protection. So there are some non-DNS means of detecting and
>     >> limiting NSEC traversals that are outwith the scope of the
>     >> draft.
> 
>     Ben> I believe experience tells us that the people interested in
>     Ben> these attacks are highly capable of disguising them well.
> 
> So what? That doesn't make the original text any less valid.

Ben is right. Rate limiting is trivially defeated by exploring the
domain slowly. The slow-down can be easily compensated by performing
several searches in parallel, or by distributing the load among several
machines. These techniques are commonly used to scan subnets and ports
today. 

Similarly, firewall filtering is hard to apply if the server intends to
publish the information in the first place.

-- Christian Huitema

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Marcos Sanz/Denic <[email-masked]>
Date: Wed, 19 May 2004 09:46:32 +0200

I concur with Simon and would feel more confortable when dropping the 
statement "there are non-DNS protocol means [...]".

Why "are"? Have we seen some implementation of it? Do we know how 
practicable it is or how well the problem gets addressed? One could say 
"there could be non-DNS protocol means..", but that is a non-statement.

The problem is there. There is no real solution today. Let's face it.

Regards,
Marcos