Subject: Re: NSEC2- and an Authenticated Denial Mechanism Flag

From: [email-masked] (Geoffrey Sisson)
Date: Thu, 27 May 2004 10:52:01 +0100 (BST)

Paul Vixie <[email-masked]> writes:

> but i guess every generation wants to learn that security through obscurity
> is an illusion, the hard way.

NSEC2 RRs are intended to prevent the zone from being _trivially_
elaborated.

It's one thing to park a car unlocked with the keys in the ignition;
it's another to park it in a garage, lock the doors, and remove the
key.

Also, NSEC2 uses strong encryption, so it isn't entirely justifiable to
charactarise it as security through obscurity.

Regards

Geoff

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: [email-masked]
Date: Thu, 27 May 2004 14:02:00 +0000

> charactarise it as security through obscurity.

	DNS use of "strong encryption" is not to provide
	confidentiality.  We're not hiding anything here.
	We're providing integrity.

--bill