[DNSOP] NSEC3 aggressive use for unsigned zones

Mukund Sivaraman <muks@isc.org> Sun, 27 November 2016 10:55 UTC

Date: Sun, 27 Nov 2016 16:25:21 +0530
From: Mukund Sivaraman <muks@isc.org>
To: dnsop@ietf.org
Message-ID: <20161127105521.GA10342@jurassic>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="cNdxnHkX5QqsyA0e"
Content-Disposition: inline
User-Agent: Mutt/1.7.1 (2016-10-04)
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/Y8nb_Lmdgh8bIrhXDBatNRIGkVs>
Subject: [DNSOP] NSEC3 aggressive use for unsigned zones
Precedence: list

draft-ietf-dnsop-nsec-aggressiveuse works for stopping random sub-domain
attacks for signed zones.

The problem exists for unsigned zones and different approaches have been
proposed:

- Bloom filtering queries (e.g. https://github.com/hdais/unbound-bloomfilter)
- Bloom filter bitfield in RRs (e.g. https://tools.ietf.org/html/draft-bellovin-dnsext-bloomfilt-00)

What are the consequences of the authoritiative server returning
synthesized unsigned NSEC3 RRs upon being signalled by the resolver
using an EDNS option? This could be spoofed by a man-in-the-middle, but
so can every unsigned answer.

		Mukund

Attachment: signature.asc

[DNSOP] NSEC3 aggressive use for unsigned zones Mukund Sivaraman
Re: [DNSOP] NSEC3 aggressive use for unsigned zon… John Levine
Re: [DNSOP] NSEC3 aggressive use for unsigned zon… Shane Kerr
Re: [DNSOP] NSEC3 aggressive use for unsigned zon… John R Levine
Re: [DNSOP] NSEC3 aggressive use for unsigned zon… Mukund Sivaraman

[DNSOP] NSEC3 aggressive use for unsigned zones

Attachment: signature.asc