Re: [dnsext] My Final Thoughts/Conclusions for forgery resistance...

["George Barwood" <[e-mail]>]

> c)  If there is no intersection between the returned RRSets, generate  a 
> THIRD query:
> c1)  If two of the three responses have overlap on the returned  RRSets, 
> accept and return the intersection of the two RRSets
> c2)  If there is no overlap between all three RRSets, DO NOT cache any 
> value, return a randomly selected one of the responses with TTL=0.

This last (c2) implies that when port randomization is unavailable,
protection may be only 16 bits.

It seems more logical to repeat until suitable protection is obtained, at
least for "essential" resource record sets. This is entirely practical, I
have been testing such a resolver now for more than a month with no
problems. I describe this in more detail in my draft

http://www.ietf.org/internet-drafts/draft-barwood-dnsext-fr-resolver-mitigations-08.txt
https://datatracker.ietf.org/drafts/draft-barwood-dnsext-fr-resolver-mitigations/

Generally I agree that repetition is fundamental, although I prefer to
formulate it in a more general way.

It needs some programming effort to implement, but does work perfectly well.



--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>