Subject: Re: dictionary attack on nameservers

From: Ted Hardie <[email-masked]>
Date: Thu, 29 Jul 2004 09:52:21 -0700

At 10:12 AM +0100 7/29/04, Geoffrey Sisson wrote:
>Miek Gieben <[email-masked]> writes:
>
>>  Why is so much effort pumped in to a new NSEC solution for DNSSEC when
>>  people can walk DNS zones so easily right now?
>
>I can't speak for everyone, but we (Nominet) are advised that we have
>a responsibility to protect the confidentiality of data in the .uk zones,
>even if this cannot be done perfectly.

Can you clarify this?  Previous messages from Jay seemed to
indicate that the data which was sensitive was actually the
data in whois, and the DNS protection was needed to prevent
a zone-walk from highlighting domain targets for whois.
If I have that wrong, I would appreciate a clarification.

For those not following CRISP, by the way, iris-core, iris-beep,
and iris-dreg are now all in the RFC editor queue.  IRIS has
facilities that allow registries to handle administrative
queries in ways whois does not.  Shifting from whois to
iris may solve this problem without going back to
the design phase yet again in DNSSEC.
			regards,
				Ted Hardie

>Also, I use to think that, even if "NSEC+" were available, that NSEC
>was sufficient for {in-addr,ipv6,e164}.arpa.  Now I'm not so sure.
>While any one zone in these hierarchies is trivially enumerable w/o
>NSEC, the elaboration of the aggregate trees is a bigger problem which
>is considerably reduced by NSEC.  (Okay, maybe not so hard to elaborate
>e164.arpa yet by any means . . .)  The reverse trees and enum may prove
>to be killer apps for NSEC+.
>
>Peter Koch <[email-masked]>
>
>>  the last 10% that makes 90% of the price ...
>
>I think this is also a good summation.
>
>Regards
>
>Geoff
>
>--
>to unsubscribe send a message to [email-masked] with
>the word 'unsubscribe' in a single line as the message text body.
>archive: <http://ops.ietf.org/lists/namedroppers/>

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Jim Reid <[email-masked]>
Date: Thu, 29 Jul 2004 19:19:56 +0100

>>>>> "Geoffrey" == Geoffrey Sisson <[email-masked]> writes:

    Geoffrey> Also, I use to think that, even if "NSEC+" were
    Geoffrey> available, that NSEC was sufficient for
    Geoffrey> {in-addr,ipv6,e164}.arpa.  Now I'm not so sure. 

These trees are trivially enumerated now. Since they have a well-known
and regular name space, enumerating them is a no-brainer. No variant of
NSEC is going to make enumeration of these zones harder. Or easier.

---

From: Florian Weimer <[email-masked]>
Date: Fri, 30 Jul 2004 14:31:52 +0200

> even if this cannot be done perfectly.

Is this a contractual requirement (mainly to protect companies during
pre-launch phases of new services), or does it follow from privacy
requirements?