Subject: RE: WG Last Call: DNSSEC bis documents

From: [email-masked] (Ted Lindgreen)
Date: Wed, 19 May 2004 10:10:05 +0200

[Quoting Marcos Sanz/Denic, on May 19,  9:53, in "RE: WG Last Call: DN ..."]
> I concur with Simon and would feel more confortable when dropping the 
> statement "there are non-DNS protocol means [...]".
> 
> Why "are"? Have we seen some implementation of it? Do we know how 
> practicable it is or how well the problem gets addressed? One could say 
> "there could be non-DNS protocol means..", but that is a non-statement.

There _are_ implementations to reduce the (privacy-) problems that
are aggrevated by zone walking, and there are people actively working
on this issue, both from the legal and technical perspective.

I think the current text is as good as it gets and propose to keep
it as it is now.

Regards,
-- ted

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Marcos Sanz/Denic <[email-masked]>
Date: Wed, 19 May 2004 10:35:57 +0200

> are aggrevated by zone walking, 

Then I am sorry for divulging FUD. Can somebody send a pointer to these 
existing solutions?

Regards,
Marcos

---

From: [email-masked] (Geoffrey Sisson)
Date: Wed, 19 May 2004 15:01:34 +0100 (BST)

Jim Reid <[email-masked]> writes:

> Rate limiting and intelligent firewall filtering can reduce the
> exposure to NSEC traversal. It should be fairly straightforward to
> train a name server implementation to detect these attacks too. Sure,
> these defences might not be much help against a well-disguised
> attack. But they do provide some level of protection. So there are
> some non-DNS means of detecting and limiting NSEC traversals that are
> outwith the scope of the draft.

FWIW we've in the last two years weve observed an increase in WHOIS
elaboration attempts against whois.nic.uk which employ pools of
unsecured WHOIS (and web) proxies, as well as what are probably
`botnets'.  I suspect that unsecured DNS resolvers are considerably
more numerous, and that no suitable rate-limiting mechanisms -- even
intelligent ones which might employ advanced pattern analysis -- will
be practicable againt NSEC RR enumeration.

Regards

Geoff