Re: dictionary attack on nameservers

[Roy Badami <[e-mail]>]

I hadn't been intending to respond to the chairs' call for 20-line
summaries, since I regard myself as an intersted bystander rather than
an active WG member...  However Olaf contacted me privately requesting
I do so, so here goes...

--------

I regard it as highly desirably to reach some sort of consensus that
includes those ccTLDs that have concerns about enumeration, and
realistically I think that means addressing their requirements, rather
than convincing them to change their requirements.  I'm pleased that
the co-chairs seem to concur that this is worth persuing...

I don't have any strong feelings as to the shape that the technical
solution should take though I note that Bloom filters have been
completely neglected in recent discussions, and I think they may still
be of possible value -- see for example Steve Bellovin's ID
http://www.research.att.com/~smb/papers/draft-bellovin-dnsext-bloomfilt-00.txt

I would argue that authenticated denial is important in a TLD, and
that provably-insecure delegations are vital, as without them the
level of security offered to customers of that TLD is diminished.

I note also that if some TLDs choose not to offer these security
guarantees, then there will be no incentive for their customers to
migrate away from transitional mechanisms such as Paul Vixie's DLV
(which does offer those guarantees, at least to participating resolvers).


       -roy

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>