Subject: Re: NSEC3 Issue 10: Potential DoS on Servers

From: Sam Weiler <[email-masked]>
Date: Fri, 17 Mar 2006 17:00:08 -0500 (EST)

On Tue, 21 Feb 2006, Geoffrey Sisson wrote:

> Issue:
>
> Significantly more work is required for a name server to respond to
> queries which require negative proofs using NSEC3 than is required for
> a client to compose and send them.  For each such query, the name
> server must repeat the hash function for the number of iterations
> specified in the NSEC3 RRs.  Consequently, name servers with NSEC3
> zones are susceptible to asymmetric DoS attacks.
>
>
> Resolution:
>
> None at present.

I don't think any resolution is needed.  We just need to call out this 
possible problem and suggest that the obvious way to avoid the problem 
is by using NSEC.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>