Re: draft-arends-dnsnr-00

["Olaf M. Kolkman" <[e-mail]>]

I would have liked to keep this genie in its bottle but it occurs that
Roy's proposal is a mixture of NSEC2 and OPT-IN specs. I would say
that the same security properties of OPT-IN apply to the Roy's
proposal. I.e. the record provides proof that a certain part of the
namescpace is insecure. In that part of the insecure namespace you can
happily spoof names away or spoof a microzoft.com response.


If we want to have both obscured names and "non-secured" intervals in
your zone, so that during initial deployment you only have to create
and sign a handful of NSEC variants than Roy's proposal is worth
investigating.

If you want a choice between "fully  secured" zone with obfuscated NSECs 
and a zone with "insecure ranges" with obfuscated NSECs than NSEC2 with
an "OPT-IN" type flag seems to be the way forward.


--Olaf
  (no hats)

PS. For a name: Hashed Insecure Interval: HII RR



---------------------------------| Olaf M. Kolkman
---------------------------------| RIPE NCC


--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>