Subject: [dnsext] FR: An argument against 0x20 and mitigation by standard labels

From: "George Barwood" <[email-masked]>
Date: Wed, 22 Oct 2008 11:07:31 +0100

A possible argument against 0x20 is that administrators, in order to lessen 
the load on their authoritative name servers from resolvers that implement 
0x20 and repetition, may start using long labels.

This could lead to increased memory requirement for caches.

Therefore a few standard labels could be defined, that SHOULD be used for 
adding 0x20 entropy.

Caches can then arrange to store these labels only once.

My suggestion would be the labels

ABCDEFGHIJKLMNOPQRSTUVWXYZ

and

ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ

giving 26 and 52 bits of entropy respectively. These are language neutral, 
and can easily be checked for correctness during manual editing.

A typical zone file would then be

$ORIGIN example.com.
@    86400 IN SOA ( ns1 hostmaster
                    2008102001 ; serial number
                    1500       ; refresh
                    600        ; retry
                    1209600    ; expire
                    3600       ; Name Error TTL
                  )
     86400 NS     NS1
     86400 NS     NS2
     86400 MX     10 MX1
     86400 MX     20 MX2
NS1  86400 A      1.2.3.4
NS2  86400 A      4.3.2.1
MX1  86400 A      1.2.3.4
MX2  86400 A      4.3.2.1
WWW  86400 CNAME  www.ABCDEFGHIJKLMNOPQRSTUVWXYZ
www.ABCDEFGHIJKLMNOPQRSTUVWXYZ 120 A 1.2.3.4

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Jelte Jansen <[email-masked]>
Date: Wed, 22 Oct 2008 12:59:01 +0200

George Barwood wrote:
> A possible argument against 0x20 is that administrators, in order to
> lessen the load on their authoritative name servers from resolvers that
> implement 0x20 and repetition, may start using long labels.
> 
> Therefore a few standard labels could be defined, that SHOULD be used
> for adding 0x20 entropy.
> 
> giving 26 and 52 bits of entropy respectively. These are language
> neutral, and can easily be checked for correctness during manual editing.
> 

2 questions come to mind, but I am probably misunderstanding the goal here;

1. Aren't you still 'short-named' at the cname record here? I.E. what
would such a setup actually accomplish?
2. Wouldn't this encourage the exact behaviour that you're trying to
protect against? (more people using longer names, even if it is limited
to 26 or 52 bytes per address)

Jelte

---

From: Nicholas Weaver <[email-masked]>
Date: Wed, 22 Oct 2008 08:32:13 -0700

On Oct 22, 2008, at 3:07 AM, George Barwood wrote:

> lessen the load on their authoritative name servers from resolvers  
> that implement 0x20 and repetition, may start using long labels.
>

I don't think this is a concern:

Lets take a resolver that has 1 Million! cache entries.  At an extra  
10B a label (for extra 0x20-padding on names?), this would be a  
whopping 10MB of memory.  Suppose the same resolver has 100M active  
cache entries.  Thats still just 1 GB.  Or about $30.

So who cares about the memory usage of slightly longer names?

---

From: "George Barwood" <[email-masked]>
Date: Thu, 23 Oct 2008 18:19:53 +0100

It's true that the memory requirements for caches are modest.

But I can imagine a few examples where wasting memory might be significant:

(1) Old, overloaded computers with modest amounts of memory. I have one of
those on my desk.

(2) Tiny devices of the future, say a computer embedded in the hologram of a
credit card, where memory and power might still be at a premium.

(3) A clockwork computer built from scrap.

My imagination may be lacking, as well.

If there is an opportunity to save resources in a protocol, at no cost, I
think 2 lines in a document is a reasonable investment.

There might be other human-level benefits (such strings will be readily
recognised as being there for entropy), and it's good protocol design to
have one preferred way to do something.

George ( who remembers upgrading the RAM on his first computer from 4
kilobytes to 16 kilobytes! )

----- Original Message ----- 
From: "Nicholas Weaver" <[email-masked]>
To: "George Barwood" <[email-masked]>
Cc: "Nicholas Weaver" <[email-masked]>; 
<[email-masked]>
Sent: Wednesday, October 22, 2008 4:32 PM
Subject: Re: [dnsext] FR: An argument against 0x20 and mitigation by 
standard labels

> Lets take a resolver that has 1 Million! cache entries.  At an extra  10B 
> a label (for extra 0x20-padding on names?), this would be a  whopping 10MB 
> of memory.  Suppose the same resolver has 100M active  cache entries. 
> Thats still just 1 GB.  Or about $30.
>

---

From: Dean Anderson <[email-masked]>
Date: Wed, 22 Oct 2008 12:16:47 -0400 (EDT)

[ Note: Post was moderated. ] 

> So who cares about the memory usage of slightly longer names?

Once that 1G gets paged out, you care.

But I think this 'entropy' in names business is just nonsense anyway. I
am sure I won't be running it, nor advising anyone else to run it.  
Same for DNSinSEC, err DNSSEC. Sorry I can't give a more detailed
response now, but I'm busy writing up a paper for NTIA on DNSSEC
insecurity.

		--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000