Re: [dnsext] Forgery resilience and meeting in Stockholm

[Nicholas Weaver <[e-mail]>]

On May 11, 2009, at 5:18 AM, Florian Weimer wrote:

> * Andrew Sullivan:
>
>> 3.  Adopt draft-vixie-dnsext-dns0x20-00.  If we do (2), then perhaps
>> this gets included in that document, or perhaps it proceeds as part  
>> of
>> a set of documents.  Let's leave the editorial process issues out of
>> the discussion, and just focus on whether we want to include this
>> strategy in the tool box.
>>
>> 4.  Adopt draft-hubert-ulevitch-edns-ping-01.txt.  As in (3), this
>> might be included as part of (2) or processed individually, but that
>> doesn't matter.
>
> Both drafts are not worth the WG's efforts, IMHO.

I can see such an argument against EDNS0-ping, but what is your  
argument against 0x20?

0x20 is just about as validated-as-you-can-get already within the  
current DNS operations.

> On the other hand, it seems to me that the current DNSSEC
> implementations require a certain level of channel security to work
> reliably.  If it turns out that source port randomization is really
> not good enough, DNSSEC is affected as well (even if it's just a
> denial of service).

I don't think this denial of service is all that significant, because  
there are easy fallbacks for such failures to generate new requests  
(it sounds like thats what Bind does already), and any resolver with  
DNSSEC is still going to need source port randomization for all the  
stuff that isn't DNSSEC yet.

There are far better things for an attacker to do than waste 2^30+  
packets in that way.


--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>