Re: [dnsext] Ghost domain names

[Florian Weimer <[e-mail]>]

* Edward Lewis:

> I looked briefly at the paper
> (http://www.isc.org/files/imce/ghostdomain_camera.pdf) and don't see
> this as a "vulnerability" but rather a result of a lack of revocation
> in the protocol.  (The paper says as much.)  Adding revocation isn't
> going to be easy.

I think before we could do that, we'd need to know how quickly the
revocation needs to take effect.  If the time period is rather short,
this rules out many potential approaches.

I'm also not sure if this is an actual problem.  For a couple of
years, we had unremovable names in COM & NET due to the way those
zones were provisioned, and while this was abused, very likely not
even intentionally, the world didn't end.  (Verisign fixed this prior
to the introduction of DNSSEC.)
_______________________________________________
dnsext mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/dnsext