Subject: EDNS PING first draft uploaded

From: bert hubert <[email-masked]>
Date: Sun, 17 Aug 2008 22:25:46 +0200

Hi everybody,

In the spirit of the request at the end of the Dublin meeting, David and I
have written a draft which describes a very simple EDNS PING option.

An "EDNS PING" is an EDNS option with an opaque payload, which the remote
server appends to the RRsets in a response.

Please find further details on:
http://www.ietf.org/internet-drafts/draft-hubert-ulevitch-edns-ping-00.txt

This draft aims to standardise the very bare semantics of EDNS PING, leaving
out everything that is not strictly required to implement this EDNS option.

This basically means that how people will *use* such PINGs is entirely up to
them, but may be the subject of a followup draft.

Paul Vixie generalised what needs to be done: add enough bits of entropy to
resist spoofing, withoug specifying how such bits might be gained. 

dns-0x20, EDNS PING, fall back to TCP and repeating queries are all ways to
gain bits, and might be used to meet the requirements of such a 'minimum
entropy required' document.

Kind regards,

Bert

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://netherlabs.nl              Open and Closed source services

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 28 Aug 2008 16:45:30 +0200

On Sun, Aug 17, 2008 at 10:25:46PM +0200,
 bert hubert <[email-masked]> wrote 
 a message of 36 lines which said:

> a draft which describes a very simple EDNS PING option.

Although you mention the DNS cookies proposal
(draft-eastlake-dnsext-cookies), you offer no rationale of why your
solution is "better". Unlike draft-reid-dnsext-aleatoric, which
follows a different path, EDNS ping seems so close of the cookies that
one can wonder why there are two proposals.

At first reading, the differences seem to be:

- EDNS ping may be simpler to implement

- the draft on EDNS ping is quite... drafty and, for instance, does
 not address downgrade attacks (compare with the use of "soft state"
 in cookies)