Subject: RE: I-D ACTION:draft-eastlake-dnsext-cookies-01.txt

From: "Eastlake III Donald-LDE008" <[email-masked]>
Date: Thu, 26 Oct 2006 10:23:44 -0400

Hi Ed,

Thanks for the rapid response, before I even got around to posting a
note about this to namedroppers.  :-)

This draft is a simple update of the -00 version to change from using an
RR to using an OPT option, as requested at the last DNSEXT meeting, and
making some minor changes to the discussion of anycast servers.

I agree with all of your suggested changes below except in connection
with section 4.2. The draft, while it recommends a way to calculate
cookies, is intended to be very liberal about allowing servers and
resolvers to use more computationally intensive or less computationally
intensive methods. But I wanted to prohibit completely degenerate
cookies. So, while I think your comment below has merit, I think a
better solution is

#4.2 Server Cookies
#
#   ...
#
#   A server MUST NOT use the same Server Cookie value for responses to
#   all requests.

s/requests/resolvers/

Thanks again,
Donald

PS: cc'ed to namedroppers with Ed's permission.

-----Original Message-----
From: Edward Lewis [mailto:[email-masked]] 
Sent: Wednesday, October 25, 2006 4:27 PM
To: Eastlake III Donald-LDE008
Cc: [email-masked]
Subject: Re: I-D ACTION:draft-eastlake-dnsext-cookies-01.txt

At 15:50 -0400 10/24/06, [email-masked] wrote:

>	Title		: Domain Name System (DNS) Cookies
>	Author(s)	: D. Eastlake 3rd
>	Filename	: draft-eastlake-dnsext-cookies-01.txt
>	Pages		: 15
>	Date		: 2006-10-24
>
>A URL for this Internet-Draft is:
>http://www.ietf.org/internet-drafts/draft-eastlake-dnsext-cookies-01.tx
t

#1.1 Contents of This Document
#
#   Section 5 describes the processing of COOKIE OPT optionby resolvers
#   and server and policies for such processing.

s/optionby/option by/

#1.2 Definitions
#
#   The term "IP address" is used herein in a length independent manner
#   and refers interchangeably to IPv4 and IPv6 addresses.

s/interchangeably to IPv4 and IPv6 addresses./ to address formats
including IPv4 and IPv6./

~Why be overly specific?

#2.1 Denial-of-Service Attacks
#
#   The normal form of the denial-of-service attacks considered herein
is
#   to send DNS requests with forged source IP addresses to a server.
The
#   intent can be to attack that server or a selected host as described
#   below.

s/normal/canonical/

Maybe that's the fix.  I kept tripping over "normal form of ... 
attack".  May canonical isn't the word either.

#4.2 Server Cookies
#
#   A server MUST NOT use the same Server Cookie value for responses to
#   all requests.

Given the definition, I don't see the need for this.  Only if just one
resolver ever contacted this server or if there was a failure in the
hash function, would *all* the responses be the same.  If only one
resolver ever contacted this server, then all the server cookie values
might be the same.

#6. NAT and AnyCast Considerations
#
#   But we have this wart called NAT [RFC3022], Network Address

s/wart/reality/

--
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-=-
Edward Lewis
+1-571-434-5468
NeuStar

Secrets of Success #107: Why arrive at 7am for the good parking space?
Come in at 11am while the early birds drive out to lunch.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>