Re: [DNSOP] Comments regarding the NSEC5

[Paul Hoffman <[e-mail]>]

> On Mar 11, 2015, at 9:39 AM, Jan Včelák <[e-mail]> wrote:
> 
> On 11.3.2015 17:30, Florian Weimer wrote:
>> On 03/11/2015 05:19 PM, Jan Včelák wrote:
>> 
>>>> It's not clear if the security goals make sense.  What do zone operators
>>>> gain if zone enumeration attacks are moved from offline to online, other
>>>> than a need to provision additional server capacity?  It's not that they
>>>> can block resolution requests from large resolvers if a part of their
>>>> client population participates in aggressive enumeration.
>>> 
>>> It dependes whether you see zone enumeration as a problem.
>> 
>> If I really want to enumerate a zone, I will just send my dictionary as
>> queries, possibly through open resolvers.  People are reckless like
>> that.  At least with NSEC3, polite attackers can do some of the
>> processing off-line, without punishing authoritative servers or
>> resolvers.  NSEC5 takes away that option.  Do the existing enumerators
>> care?  Who knows.
> 
> I really can't tell. I don't know.

Proposal: until there is evidence that there is a community that needs the features of NSEC5 that cannot be easily replicated in NSEC3, this WG does not consider a protocol change that would require every resolver to be updated.

--Paul Hoffman