IETF Logo Mail Archive

Re: [dnsext] Authenticated denial of existence...

Miek Gieben <miek@miek.nl> Wed, 20 November 2013 13:05 UTC

Return-Path: <miek@miek.nl>
X-Original-To: dnsext@ietfa.amsl.com
Delivered-To: dnsext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE0DD1ADF7E for <dnsext@ietfa.amsl.com>; Wed, 20 Nov 2013 05:05:57 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.6
X-Spam-Level:
X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id omLjra0BAJlF for <dnsext@ietfa.amsl.com>; Wed, 20 Nov 2013 05:05:55 -0800 (PST)
Received: from mail-wg0-f44.google.com (mail-wg0-f44.google.com [74.125.82.44]) by ietfa.amsl.com (Postfix) with ESMTP id 9B0001ADF89 for <dnsext@ietf.org>; Wed, 20 Nov 2013 05:05:55 -0800 (PST)
Received: by mail-wg0-f44.google.com with SMTP id k14so9073840wgh.23 for <dnsext@ietf.org>; Wed, 20 Nov 2013 05:05:48 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:date:from:to:cc:subject:message-id :mail-followup-to:references:mime-version:content-type :content-disposition:in-reply-to:user-agent; bh=xIn2lDyizgjSh/5hLLzjC35qcEql3PPleYFyPgnZZ5s=; b=iK4+zofrhlqAmIoVymECH/mHzsRKlZRs/f2qUxy/b1QtOJnihwV0fsLqVpB/kqIC0l +7sJO/NfJkUsVzhQw0PWCQ9QE/5vwBToODqcGjY/fV5VTiSht942iCDsIkn9DenbBEeC h8Cy1fgU/Xgur4sT3tzJW32RZCGpdiUktpwt20un3vQ+u+LCrxqRxE0TR7cL+unSSf9u 9xrHCBViY34QaLMNseBTrZUTrGyPLGvyqAUhtnHUHRpcvAbWMfm0OVZOrr3U9uUDZJ2n p3zUgNbTFVMS+7FpBfYJ0Eu64cC5aQC0velN+3nnVgTAEUadulyafs6plKokIp8tsSuy nMlw==
X-Gm-Message-State: ALoCoQlO9xYSYqE3zDFAp7PFcEENgb/lbjxT20ihDgkRCpdICHpGRolb0mYR6JmaZ7Zaby8eqCcK
X-Received: by 10.194.1.139 with SMTP id 11mr533418wjm.33.1384952748674; Wed, 20 Nov 2013 05:05:48 -0800 (PST)
Received: from miek.nl ([2a01:7e00::f03c:91ff:feae:e74c]) by mx.google.com with ESMTPSA id je17sm16038887wic.4.2013.11.20.05.05.47 for <multiple recipients> (version=TLSv1.2 cipher=RC4-SHA bits=128/128); Wed, 20 Nov 2013 05:05:47 -0800 (PST)
Date: Wed, 20 Nov 2013 13:05:46 +0000
From: Miek Gieben <miek@miek.nl>
To: Tony Finch <dot@dotat.at>
Message-ID: <20131120130546.GA28610@miek.nl>
Mail-Followup-To: Tony Finch <dot@dotat.at>, Ted Lemon <ted.lemon@nominum.com>, "<dnsext@ietf.org> Group" <dnsext@ietf.org>
References: <CFD6B510-D70E-4308-BF3E-B2E7C2ADCBEB@nominum.com> <alpine.LSU.2.00.1311201202570.11548@hermes-2.csi.cam.ac.uk>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <alpine.LSU.2.00.1311201202570.11548@hermes-2.csi.cam.ac.uk>
User-Agent: Vim/Mutt/Linux
X-Home: http://www.miek.nl
Cc: Ted Lemon <ted.lemon@nominum.com>, "<dnsext@ietf.org> Group" <dnsext@ietf.org>
Subject: Re: [dnsext] Authenticated denial of existence...
X-BeenThere: dnsext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: DNS Extensions working group discussion list <dnsext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsext>, <mailto:dnsext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsext/>
List-Post: <mailto:dnsext@ietf.org>
List-Help: <mailto:dnsext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsext>, <mailto:dnsext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 20 Nov 2013 13:05:58 -0000

[ Quoting <dot@dotat.at> in "Re: [dnsext] Authenticated denial o..." ]
> Ted Lemon <ted.lemon@nominum.com> wrote:
> 
> > Is this on anyone's radar?   What are your thoughts about it?
> >
> > https://datatracker.ietf.org/doc/draft-gieben-auth-denial-of-existence-dns/
> 
> A really nice and helpful document.

Thanks.

> A suggestion:
> 
> It should discuss RFC 4470 Minimally Covering NSEC Records, and the
> related idea of NSEC3 "white lies" implemented by Dan Kaminsky's
> Phreebird. (I can't immediately find a good description of how the latter
> works.) Both these require on-demand synthesizing and signing of negative
> responses, whereas the mechanisms that Miek's draft currently covers are
> all designed for serving from a pre-signed zone file without requiring
> online private keys.

I'm not sure how far in the review process we actually are with this draft,
and adding text about this is a considerable effort. However I think it is
valuable to have text on this in this draft too.

Regards,

-- 
   Miek Gieben

v2.39.1 | Report a Bug | By Email | System Status