Re: [v6ops] NAT64/DNS64 and DNSSEC

[Ondřej Caletka <[e-mail]>]

Hello,

Dne 28.7.2015 v 21:58 [e-mail] napsal(a):
> but isn't there a gap that when performing the RFC7050 64pref detection by querying ipv6only.arpa, an attacker can spoof this answer (DNSSEC won't work here, for example, the attacker - when between the client and the DNS - can return for example 2001:db8::192.0.0.170 (where 2001:db8:: is a prefix owned by the attacker)) and then attract all IPv4 traffic from the victim?

That is why there is a requirement in RFC7050 Section 3.1. to validate
network-specific NAT64 prefix using reverse and forward DNSSEC secured
queries. The only problem is that there is no way so far how to seed the
list of trusted NSP domains. Instead of asking users "Do you want to
trust the network prefix dns64.example.org?", there could probably be
some matching with domain name received by other means like DHCP or DNSSL.

Of course, using the Well-known prefix is on the safe side, and should
be IMO used wherever applicable.

Cheers,
Ondřej Caletka