Re: [dnsext] Forgery resilience and meeting in Stockholm

[Nicholas Weaver <[e-mail]>]

On May 8, 2009, at 11:14 AM, Andrew Sullivan wrote:
> We think it would be better if we came to some more or less shared
> agreement on what to do in this space (including nothing).  The
> portion of the meeting we had in Dublin that was dedicated to this
> topic seems not to have inspired consensus.  Therefore, we would like
> to present five options for consideration:
>
> 1.  Do nothing, and take all energy that might be devoted to this
> effort and direct it towards DNSSEC deployment.
>
> 2.  Adopt draft-wijngaards-dnsext-resolver-side-mitigation-01.txt, and
> include in it recommendations to do nothing else except what that
> document contains.  Remove from section 3 any strategies we do not
> want to adopt.  (Note that this latter condition entails decisions
> about the next two options.)

I'd argue against one, simply because in 2 there are some really key  
ideas, especially in section 3.2 and 3.3.

Notably, 3.2 and 3.3 (or variant approaches) eliminate the race-until- 
win nature of out-of-path attacks, which increase attacker complexity  
in time rather than packets.

They also only directly affect resolvers from a protocol viewpoint  
(all the additional queries are within specification), and the only  
open questions are those of load on authorities and the additional  
queries from resolvers.

Preliminary evaluations I did on a slightly different way of phrasing  
3.3 suggested that the load magnification was tolerable, and if  
desired, I could investigate doing a more comprehensive analysis of  
the increased load on various portions of the resolution chain.


--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>