Subject: [DNSOP] Using NSEC3 for opt-out, was Re: Comments regarding the NSEC5

From: Edward Lewis <[email-masked]>
Date: Thu, 12 Mar 2015 12:14:46 +0000

On 3/12/15, 6:31, "Florian Weimer" <[email-masked]> wrote:

>And does anyone actually use opt out with NSEC3?

Currently twenty-one TLDs use NSEC3 with 0 iterations and no salt.
Nineteen more use no salt with more than 1 iteration.

That's just a count of what's in the root zone delegations.  I haven't
asked if they all use NSEC3 for opt-out, but given those parameters and
based on at least one private conversation with one of the operators, I'm
sure these are 40 cases of zones using NSEC3 for it's opt-out capability.
 (Subsets of the 40 zones are operated by the same entity, so it's not
necessarily 40 operators.)

---

From: Ondřej Surý <[email-masked]>
Date: Sun, 15 Mar 2015 17:30:27 +0100 (CET)

JFTR .cz was asked by "The Office for Personal Data Protection" to implement measures to protect the personal data for domain holders.  NSEC3 was part of the solution.

O.

--
 Ondřej Surý -- Chief Science Officer
 --------------------------------------------
 CZ.NIC, z.s.p.o.    --     Laboratoře CZ.NIC
 Milesovska 5, 130 00 Praha 3, Czech Republic
 mailto:[email-masked]    https://nic.cz/
 --------------------------------------------

----- Original Message -----
> From: "Edward Lewis" <[email-masked]>
> To: [email-masked]
> Sent: Thursday, March 12, 2015 1:14:46 PM
> Subject: [DNSOP] Using NSEC3 for opt-out,	was Re:  Comments regarding the NSEC5

> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop

---

From: Patrik Fältström <[email-masked]>
Date: Sun, 15 Mar 2015 19:36:19 +0100

> On 15 mar 2015, at 17:30, Ondřej Surý <[email-masked]> wrote:
> 

Can you explain more how that was part of the solution?

   Patrik

---

From: Ondřej Surý <[email-masked]>
Date: Sun, 15 Mar 2015 21:19:26 +0100

This is really vague memory of it, but the main problem was that NSEC enumeration with public whois allowed data scraping. 

Thus whois rate limiting, implementation of "hide-this" flags and NSEC3 was deployed to prevent majority of it. Some limits were also implemented in the registry to prevent cross-registrar data digging via EPP. 

O. 

On March 15, 2015 7:36:19 PM GMT+01:00, "Patrik Fältström" <[email-masked]> wrote:
>> JFTR .cz was asked by "The Office for Personal Data Protection" to
>implement measures to protect the personal data for domain holders. 
>NSEC3 was part of the solution.
>

-- 
Sent from my Android device with K-9 Mail. Please excuse my brevity.

---

From: Patrik Fältström <[email-masked]>
Date: Mon, 16 Mar 2015 02:44:28 +0100

> On 15 mar 2015, at 21:19, Ondřej Surý <[email-masked]> wrote:
> 

Ok, but the real problem was then that all registered domain names where also delegated? Together with all data existing in Whois?

Not really DNSSEC related.

> Thus whois rate limiting, implementation of "hide-this" flags and NSEC3 was deployed to prevent majority of it. Some limits were also implemented in the registry to prevent cross-registrar data dig…

Ok.

   paf