Subject: NSEC3 chain walking

From: Marcus Better <[email-masked]>
Date: Mon, 31 Oct 2005 18:35:36 +0100

Hello,

I have a comment concerning the problem of chain walking mentioned in
section 11 of draft-ietf-dnsext-nsec3-03:

   "Walking the NSEC3 RRs will reveal the total number of records in the
   zone, and also what types they are.  This could be mitigated by
   adding dummy entries, but certainly an upper limit can always be
   found."

It seems that this little nuisance can be eliminated quite easily.

(Disclaimer: I am not a DNS expert, so if this is really dumb or has
already been discussed, I apologize for wasting your time.)

The following changes are made to the draft:

1. The Next Hash Ownername field is modified so that it contains a
_double_ hash of the next hashed ownername, i.e. H2(H1(name)) where H1
and H2 are hash algorithms. (One could possibly take H1=H2.)

2. The hash order is now determined according to the double hash.

Note that the ownername of the NSEC3 RR is still the single hash of the
owner name. So the record would look in principle like
  H1(foo.example.)	NSEC3	H2(H1(bar.example.))

This record would prove the non-existence of original ownernames
name.example such that
  H2(H1(foo.example.)) < H2(H1(name.example.)) < H2(H1(bar.example.))

Since the RR only contains the double hash of the next name, which is
not used as an ownername in the zone, this information cannot be used to
make further queries. So it becomes impossible to walk the NSEC3 chain.

An obvious drawback is that the verifier must do extra work to compute
the additional hashes.

Regards,

Marcus

---

From: Chris Thompson <[email-masked]>
Date: Mon, 31 Oct 2005 17:59:12 +0000 (GMT)

> An obvious drawback is that the verifier must do extra work to compute

It prevents sequential walking, but it is just as subject to random
probing as using H2(H1(x)) as the hash function in the first place 
would be. And we know that random probing is (nearly) as effective
as sequential walking, don't we?

-- 
Chris Thompson
Email: [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>