Subject: draft-lozano-nsec-random-00

From: Gustavo Lozano Ibarra <[email-masked]>
Date: Tue, 14 Dec 2004 11:12:28 -0600

I have been talking with some colleagues at NIC Mexico and others organizations about an idea to address the issue of DNS enumeration in the DNSSECbis protocol.

I wrote a draft describing the idea and I would appreciate receiving comments about it.

The draft : http://www.ietf.org/internet-drafts/draft-lozano-nsec-random-00.txt

Thank you.

--
 
Gustavo Lozano Ibarra
NIC-Mexico Top Level Domain .MX
http//www.nic.mx
Tel/Fax. +52(81)83875346 ext. 117

El contenido del presente mensaje de datos es confidencial y no podrá 
modificarse, distribuirse y/o difundirse por ningún medio sin la previa 
autorización del emisor original, así mismo no se considera oferta, 
propuesta o acuerdo. El Emisor no es apoderado de NIC-México ni tiene 
facultad alguna para obligar a NIC-México con la transmisión y contenido del 
presente mensaje de datos, incluyendo el (los) archivo(s) anexo(s).

The content of this data transmission is confidential, therefore, it shall 
not be modified, distributed and/or disclosed through any mean without the 
original sender's previous authorization. Any information, offer or 
agreement made by the sender of this data transmission, should be considered 
as personal and not binding for NIC-Mexico.  

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: David Blacka <[email-masked]>
Date: Tue, 14 Dec 2004 12:31:51 -0500

> The draft : http://www.ietf.org/internet-drafts/draft-lozano-nsec-random-00.txt

Well, for one, you would be enabling a man in the middle to provably 
deny the existence of anything in the zone, which is contrary to the 
design goals of DNSSEC.

-- 
David Blacka    <[email-masked]>
Sr. Engineer    VeriSign Applied Research

---

From: "Scott Rose" <[email-masked]>
Date: Fri, 17 Dec 2004 14:15:37 -0500

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of David Blacka
>
> > I have been talking with some colleagues at NIC Mexico and
> others organizations about an idea to address the issue of DNS
> enumeration in the DNSSECbis protocol.
> >
> > The draft :
> http://www.ietf.org/internet-drafts/draft-lozano-nsec-random-00.txt
>

Also, one of the early design principles was that DNSSEC would not add names
to the zone.  That is, the same canonical order of names must exist in both
the signed and unsigned zones.  Personally, I don't know how important this
is, but I feel uneasy with schemes that add names to the zone when they
become signed.

Scott

---

From: Peter Koch <[email-masked]>
Date: Fri, 17 Dec 2004 21:52:28 +0100

> The draft : http://www.ietf.org/internet-drafts/draft-lozano-nsec-random-00.t

You're introducing competing NSEC RRs separating NXDOMAIN from NOERROR/NODATA.
The choice of the NSEC RR to be sent with the answer needs to be specified
more precisely (since the server may not be able to know which one was
randomly generated), but essentially you're giving up authenticated denial
of existence (of names): 

In your zone

   a.example (random generated) 
   b.example (original) 
   c.example (random generated) 
   e.example (original) 
   f.example (random generated) 
   h.example (original) 
   z.example (random generated) 
 
you create NSEC RRs pointing from one randomly generated name to 'the next',
but since there's no information in those randomly generated names, the
approach can be reduced to a single NSEC RR spanning the whole zone. Now,
all names within the zone (any zone) can be proven not to exist, including,
of course, those that do actually exist and own RRsets.

-Peter