Subject: Re: DNSSEXT draft agenda IETF 60

From: Jim Reid <[email-masked]>
Date: Mon, 26 Jul 2004 11:08:15 +0100

>>>>> "Miek" == Miek Gieben <[email-masked]> writes:

    >> - Reid: DNS-MODA plug (approx 3 min, no discussion)

    Miek> Does this item belong in a technical oriented meeting?
    Miek> Esp. when there is also no discussion possible?

Well the WG chairs seem to think so... :-)

FYI, all I'll be doing is announcing the time and place of a meeting
in the Sheraton for those who want to know more about DNS-MODA. The
meeting is open to everyone and it will have plenty of time for
discussion. [You can even bring your own black helicopters. :-)] If my
slot in the WG agenda lasts as long as 3 minutes, it'll be a miracle. A
discussion about DNS-MODA would not be appropriate in the WG. However
an announcement about it is. Consider this DNS-MODA event as a sort of
unofficial BoF.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Wed, 28 Jul 2004 23:02:24 +0000

miek wrote:

> ..., I should get almost the whole NL zone.  I haven't look into this
> but 80%, maybe 90% sure looks feasible. And the better the dictionary,
> the better the results of course. Also the attack is highly parallel,
> 2 computers querying 2 different nameserves, would cut this time in
> half.

actually, if you have bind8 or bind9 and if your operating system has
kernel-visible pthreads, you can parallelize using the "irs" interface.
see "bind8/contrib/manyhosts/" for an example of how altavista used to
postprocess its web logs back in the days before google.  (so, you don't
actually need two computers to parallelize this function.)

> So within a day you can get an AXFR of any zone out there (the bigger
> the zone, the more hits you get, the more accurate your "AXFR" will
> be). So my question right now is:
> 
> Why is so much effort pumped in to a new NSEC solution for DNSSEC when
> people can walk DNS zones so easily right now?

all i can say is, humans are involved, and humans love complexity, and
humans hate to be told that they're solving the wrong problem.  let's
have a look at the ol' archives, shall we?

     From: Paul Vixie <[email-masked]>
     To: [email-masked]
     Subject: Re: Proposal to fix NSEC 
     Date: Sat, 22 May 2004 16:34:39 +0000

     ...

     What *I* think, since you mentioned it, is that TLD holders who
     fear enumeration think that restricting AXFR is actually preventing
     enumeration, and that if they'd spend a few years in the trenches
     against spammers and data miners they would come to the conclusion
     that "all useful malevolent forms of enumeration are already
     possible and are already being done" and would then conclude that a
     one-decade DNSSEC is better than a two-decade DNSSEC, given that
     all other things are equal.

or, even more succinct:

     From: Paul Vixie <[email-masked]>
     To: [email-masked]
     Subject: Re: Proposal to fix NSEC 
     Date: Sun, 23 May 2004 21:28:02 +0000

     > I am illustrating that Paul cannot enumerate the zone either
     > accurately or completely.

     i never said i could.  what i said was that i could get a complete
     useful enumeration, containing everything a spammer or marketroid
     would need in order to make "the bad use" of whois that ccTLD's
     supposedly don't want made.

yet, interest in NSEC2 (and now NSEC3) persists.  thank you for proving
that useful enumeration does not depend on AXFR or NSEC, but i think that
the proponents of NSEC2 (and now NSEC3) believed my assertions on this
point and will not be swayed by your evidence.  they do not doubt that
"all useful enumerations are already possible", but they live in a world
where they have to be seen "doing something about the problem".  because
of the way IETF works, that probably means "we all have to be seen doing
something about the problem" even though, as first stated, and now proven,
there either is no problem, or the problem doesn't come from NSEC.

> Btw, I will be happy to try this out on other TLD's out there :-)

i suggest that you do them all.  it won't change anything -- we'll still
rush headlong into another decade of incremental complexity in dnssec --
but it will be satisfying to have the true purpose of that complexity
exposed in advance, for all to see.

note-- ISC will begin work on NSEC3 as soon as there's funding/interest
in it.  the views expressed here are personal, and do not reflect isc's
commitment to implement whatever the community decides upon.

paul