Re: Additional filtering of responses

[Masataka Ohta <[e-mail]>]

Wouter Wijngaards wrote:

> A new version of my resolver (Unbound) with additional filtering of
> responses to counter the recently disclosed vulnerability at blackhat
> was just released. This filtering is in addition to the bailiwick
> checking.

No.

If you properly handle additional glue As to be tagged by query,
glue As does not need any bailiwick checking.

As answer non-glue additional information needs exact matching with
query, the information needs no bailiwick checking.

"Bailiwick" was considered to be a valid concept for non-glue
information but is never a valid concept for glue-As.

No WG consensus can override scientific nature of the DNS referral
mechanism.

> The best solution is of course DNSSEC.

A better solution, a lot more easier to deploy than DNSSEC, is to
use TCP, deployment of which is, of course, still hard.

However, it is only as hard as updating all the install bases,
including those on various types of NAT boxed, of DNS so that
they can treat glue and other information properly.

> Crypto signatures instead of randomisation games. Enable DNSSEC
> validation now.

Because of complexity of DNSSEC caused by poor combination of DNS
and public key cryptography, there are a several subtle hacking,
which are not present in PODS (plain old DNS), performed to make
it work.

With such additional subtlities, it is practically impossible to
be sure that DNSSEC is more secure than PODS.

Remember that even PODS has a lot of unexpected security
holes.

							Masataka Ohta


--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>