Subject: Re: draft-lozano-nsec-random-00

From: David Blacka <[email-masked]>
Date: Tue, 14 Dec 2004 12:31:51 -0500

Gustavo Lozano Ibarra wrote:
> I have been talking with some colleagues at NIC Mexico and others organizations about an idea to address the issue of DNS enumeration in the DNSSECbis protocol.
> 
> I wrote a draft describing the idea and I would appreciate receiving comments about it.
> 
> The draft : http://www.ietf.org/internet-drafts/draft-lozano-nsec-random-00.txt

Well, for one, you would be enabling a man in the middle to provably 
deny the existence of anything in the zone, which is contrary to the 
design goals of DNSSEC.

-- 
David Blacka    <[email-masked]>
Sr. Engineer    VeriSign Applied Research

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Peter Koch <[email-masked]>
Date: Fri, 17 Dec 2004 21:52:28 +0100

> The draft : http://www.ietf.org/internet-drafts/draft-lozano-nsec-random-00.t

You're introducing competing NSEC RRs separating NXDOMAIN from NOERROR/NODATA.
The choice of the NSEC RR to be sent with the answer needs to be specified
more precisely (since the server may not be able to know which one was
randomly generated), but essentially you're giving up authenticated denial
of existence (of names): 

In your zone

   a.example (random generated) 
   b.example (original) 
   c.example (random generated) 
   e.example (original) 
   f.example (random generated) 
   h.example (original) 
   z.example (random generated) 
 
you create NSEC RRs pointing from one randomly generated name to 'the next',
but since there's no information in those randomly generated names, the
approach can be reduced to a single NSEC RR spanning the whole zone. Now,
all names within the zone (any zone) can be proven not to exist, including,
of course, those that do actually exist and own RRsets.

-Peter