Subject: RE: Proposal to fix NSEC

From: "Loomis, Rip" <[email-masked]>
Date: Thu, 20 May 2004 12:49:00 -0400

> > The problem is that [online signing is] just too prone to
> > DoS attacks....   Which is BAD.
> 
> A standard could be established to help thwart DoS attack.
> 
> 1) Only use signatures for queries from named name servers 
> (ns record exists).

This blatantly ignores the completely common case where
the set of recursive/caching/resolving nameservers for an
organization are separate from the set of authoritative
nameservers (with NS records for the zone delegation)
for that organization.  As a result, your notional standard
is not likely to work.

  --Rip

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Sal Mangiapane" <[email-masked]>
Date: Thu, 20 May 2004 13:09:44 -0400

> for that organization.  As a result, your notional standard

This is exactly what each group would need to establish.  In this case, what the criteria for DNS would be.

The Internet benefits from the ubiquity of DNS.  Couldn't the same be true for a single system of digital signatures?

---

From: "Sal Mangiapane" <[email-masked]>
Date: Thu, 20 May 2004 22:47:25 -0400

> > nameservers 

These DNS servers can receive a trusted response but could not respond
to the originating request with a trusted (signed) answer.
They can't because they are unknown by authoritative nameservers.
I'm thinking they are outside the chain of trust.
What am I missing?  Will these become obsolete?

Regards,

Sal

Salvatore Mangiapane