Subject: I-D Action:draft-ietf-dnsext-forgery-resilience-05.txt

From: [email-masked]
Date: Thu, 26 Jun 2008 07:45:04 -0700 (PDT)

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the DNS Extensions Working Group of the IETF.

	Title           : Measures for making DNS more resilient against forged answers
	Author(s)       : B. Hubert, R. van Mook
	Filename        : draft-ietf-dnsext-forgery-resilience-05.txt
	Pages           : 24
	Date            : 2008-06-26

The current Internet climate poses serious threats to the Domain Name
System.  In the interim period before the DNS protocol can be secured
more fully, measures can already be taken to harden the DNS to make
'spoofing' a recursing nameserver many orders of magnitude harder.

Even a cryptographically secured DNS benefits from having the ability
to discard bogus responses quickly, as this potentially saves large
amounts of computation.

By describing certain behaviour that has previously not been
standardised, this document sets out how to make the DNS more
resilient against accepting incorrect responses.  This document
updates RFC 1034.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-dnsext-forgery-resilience-05.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 26 Jun 2008 09:29:20 -0700

The title of section 9 disagrees with the fact that the section 
contains MUST requirements.

>9.  Recommended Countermeasures
>
>    Given the above, a resolver implementation MUST match responses to
>    the following attributes of the query:
>
>. . .
>
>    Resolver implementations MUST have the ability to:

Either the title of the section needs to be changed to "Required 
Countermeasures", or the MUSTs should be downgraded to SHOULDs with 
explanations of when the SHOULDs do not need to be followed. Changing 
the title seems like the better option.

--Paul Hoffman, Director
--VPN Consortium

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Olafur Gudmundsson <[email-masked]>
Date: Thu, 26 Jun 2008 17:18:57 -0400

Paul, I'm treating your comment as a WGLC comment,

At 12:29 26/06/2008, Paul Hoffman wrote:
>explanations of when the SHOULDs do not need to be followed. 
>Changing the title seems like the better option.

Thanks for this comment you are right that "Required Countermeasures"
is a better title.
I will put this in the queue for things to change after the WGLC.

         Olafur