Subject: RE: Proposal to fix NSEC

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sun, 23 May 2004 07:26:19 -0700

> > ... though personally I agree with Phillip Hallam-Baker's analysis
> > that more information is revealed.
> 
> If he said that, he was wrong.  More likely you misunderstood 
> him.  The same information is revealed, it just happens slightly 
> later and is an indirect activity. 

This shows why DNSEXT should transfer work on DNSSEC to the security
area. 

From a security point of view more information IS revealled. The
computational difficulty of arriving at an enumeration is significantly
reduced with the DNSEXT. The alternative attack routes suggested
as equivalent are not.

Comparative security analysis is a VERY weak form of argument. 
A huge number of security vulnerabilities result from faulty
comparative argument, in fact it is one of the most common causes 
of security flaws. The errors in WEP were due to that type
of reasoning. 

The IETF has a reputation for designing security mechanisms that
are so completely over-designed that they are undeployable, while
failing to meet security requirements considered critical by end
users. IPSEC refused to address NAT but created a negotiation 
mechanism for key negotiation.

If you want anyone to use DNSSEC then you had better address the
requirements of the security community.

		Phill

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: [email-masked]
Date: Sun, 23 May 2004 14:56:45 +0000

> This shows why DNSEXT should transfer work on DNSSEC to the security

	Again?  The last time the security area had DNSSEC, we 
	got stuff that could not be deployed due to excessive
	"chatter" btwwn parent and child.  There are more good	
	security people on the DNS lists than DNS people of any sort
	on the security lists.  

> requirements of the security community.

	Philip, why do you presume that the "security" community speaks
	with a single voice? 

> Phill

--bill