[dnsext] draft-barwood-dnsext-fr-resolver-mitigations-03

["George Barwood" <[e-mail]>]

I have revised my draft at

http://www.ietf.org/internet-drafts/draft-barwood-dnsext-fr-resolver-mitigations-03.txt

( Latest version at : 
https://datatracker.ietf.org/drafts/draft-barwood-dnsext-fr-resolver-mitigations/ )

Abstract:

   Describes mitigations against spoofing attacks on DNS, including:

   (1) Repeating the query, including techniques for handling
       non-deterministic responses.

   (2) Prepending a random nonce to the question where a referral is
       probable.

   (3) Estimating the entropy available, taking into account
      (a) Observed packets with incorrect IDs.
      (b) Records where the owner name does not match the question.
      (c) The previous content of the cache.

New is that port randomization  must not be combined with query repetition, 
and a revised treatment of
convergence of non-determistic responsese that preserves RRset integrity ( 
although this can be spoofed ).

My point of view is that cache policy ( as described by Nicholas Weaver ) is 
not the cleanest approach,
and that simple repetition, while boring, is the best approach for a general 
purpose recursive resolver.

Other tricks ( such as 0x20, port randomization, a random nonce ) can be 
used to reduce the number of
queries needed, but are not essential.

George Barwood 



--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>