Subject: RE: Proposal to fix NSEC

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sun, 23 May 2004 08:32:13 -0700

> SLD holders outnumber TLD holders by a factor of many 
> millions.  As an SLD
> holder I can tell you that I do not fear enumeration as much as I fear
> spoofing.  There are a few SLD holders who hold the opposite 
> view, just as
> among TLD holders you will find both views.

You are not typical of an SLD holder.

The community that has to be convinced here are the people who
operate corporate firewalls. If you do not have a firewall yet
you are not going to be interested in DNSSEC.

I speak to that communiuty on a regular basis. We actually operate
a lot of firewalls on an outsourced basis. 

That community does not want to have people walk their domain
for very good reason. Dealling with attacks costs real money.
Allowing domain enumeration will cost these people real money
as it will mean that systems will be attacked which the attacker
would not otherwise have discovered.

> When the "NO RR" was evaluated by the dnsext working group, 
> these opposing
> requirements were taken into account, and anti-enumeration 
> lost out.  

So did reality. 

Agenda denial is not a very credible tactic. Demand for DNSSEC
is negligible. Give me the names of ten supporters of DNSSEC in
its current form who are influential in the security community.

Not only is the community of potential DNSSEC users not represented
in this group, any time someone does drop by to make a request
they get met with hostility and patronizing remarks.

> If the WG made the wrong choice and if DNSSEC is 
> unimplementable because TLD
> holders fear enumeration and so SLD holders will have secure 
> path to the
> root zone, then it appears that there's really no choice 
> except to declare failure.  

Ah my way or the high way eh?

> > I would suggest there is perhaps a positive correlation 
> between on the
> > one hand to the IETF listening to to the requirements of those who
> > want to deploy a protocol on the one hand, and the protocol actually
> > getting deployed on the other.
> 
> Many voices were heard.  Primary among them were SLD holders, 
> who either
> don't care about enumeration, or who fear a two-decade approach to
> DNSSEC even more, or who fear spoofing even more.

The requirement denial approach seems to be the main reason
for delay. DNSSEC would have been deployed already if OPTIN
had been accepted.

> What *I* think, since you mentioned it, is that TLD holders who fear
> enumeration think that restricting AXFR is actually preventing

The enumeration issue is going to be a much bigger issue at
the SLD level. In fact that is what the NSA guy said in a 
DNSEXT meeting four years ago, for him enumeration is a real
issue.

The only reason this is taking so long is institutional. Over
a century of use has proved Roberts Rules of order to be a
much more effective way to run a meeting than the IETF has
devised. In OASIS we regularly complete specs much more 
complex than DNSSEC within two years.

I suggest that the solution to this problem is to submit
a new draft that describes an OPT-IN and OBFUSCATED NXT
record as 'experimental'. The spam and phishing groups do
not care a jot over spec level issues but they do care
about deployability, the enumeration issue and who is 
prepared to endorse the spec. It is also much more likely
that this application area will be a killer app for
DNSSEC than preventing spoofing. It has taken ten years
and a major spam crisis for people to realize that email 
spoofing was a sufficiently bad thing that something should
be done about it.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Peter Koch <[email-masked]>
Date: Sun, 23 May 2004 17:52:05 +0200

> would not otherwise have discovered.

this "ostrich approach" is the one reason why I'd really like to see NSEC in
its current form. Zone walking/AXFR has nothing to do with end system security
and "hiding" potential attack targets by AXFR blocks is dangerous at best.
What do these people do to make their IP adresses less guessable? Deploy IPv6?
This is not what the thread was started for and this kind of "security" will
distract from the real deployment issue here. The "registry type" zones are
special and it's them we need a solution for.

-Peter