Re: DS and Opt-in - a proposal

[Roy Arends <[e-mail]>]

On Thu, 3 Jan 2002, Steven M. Bellovin wrote:

> In message <[e-mail]>, Roy Arends writes
> :
>
> >We are not talking about authenticated [denial of] existence in general,
> >only about authenticated [denial of] existence of unsecured names.
> >
> >Imagine going into a tourist office (.city), the only authoritative
> >place in town to get the authenticatable, verifiable information from.
>
> Let me point folks at draft-bellovin-dnsext-bloomfilt-00.txt, which is
> designed to address that issue.
>
> (a) Is the issue important enough to be worth introducing a brand-new
> mechanism at this time?
>
> (b) Is the false positive rate acceptable?
>
> (c) If so, is the protocol complexity of this suggestion acceptable?
>
> (d) Is it operationally real?


The idea of using bloom-filters is interesting, but I've
some small concerns about the following:

wrt loops:

In the paper there is an example of using an url in a resource record:

     https://bloomfilter.ns.example.com?324+3248+23980+89732+...

1) this triggers another lookup, which uses the DNS. What if
   "bloomfilter.ns.example.com" does not exist ? How is that denied ?

2) How is the existence of the bloom resource record containing the url
   denied ?

My 0.02 Euro

Roy Arends
Nominum



to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.