Subject: Re: dictionary attack on nameservers

From: Alex Bligh <[email-masked]>
Date: Thu, 29 Jul 2004 20:19:04 +0100

--On 29 July 2004 19:19 +0100 Jim Reid <[email-masked]> wrote:

> These trees are trivially enumerated now. Since they have a well-known
> and regular name space, enumerating them is a no-brainer. No variant of
> NSEC is going to make enumeration of these zones harder. Or easier.

I am not sure enumerating ipv6.arpa necessarily has to be trivial (if
there are large delegations) but AFAICS you are right with the others.

Alex

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Roy Badami <[email-masked]>
Date: Thu, 29 Jul 2004 21:45:39 +0100

>>>>> "Alex" == Alex Bligh <[email-masked]> writes:

    Alex> I am not sure enumerating ipv6.arpa necessarily has to be
    Alex> trivial (if there are large delegations) but AFAICS you are
    Alex> right with the others.

I don't think large delegations make a difference.  You can
distiniguish empty non-terminals from non-existent domains.

So when you walk the tree you stop descending only when you get
NXDOMAIN.  If you get no records back, but no error, then you know
there's something below that point in the tree, and carry on
descending.

      -roy