Subject: [DNSOP] I-D Action: draft-fujiwara-dnsop-nsec-aggressiveuse-03.txt

From: [email-masked]
Date: Thu, 17 Mar 2016 23:05:34 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Domain Name System Operations of the IETF.

        Title           : Aggressive use of NSEC/NSEC3
        Authors         : Kazunori Fujiwara
                          Akira Kato
	Filename        : draft-fujiwara-dnsop-nsec-aggressiveuse-03.txt
	Pages           : 14
	Date            : 2016-03-17

Abstract:
   While DNS highly depends on cache, its cache usage of non-existence
   information has been limited to exact matching.  This draft proposes
   the aggressive use of a NSEC/NSEC3 resource record, which is able to
   express non-existence of a range of names authoritatively.  With this
   proposal, it is expected that shorter latency to many of negative
   responses as well as some level of mitigation of random sub-domain
   attacks (referred to as "Water Torture" attacks).  It is also
   expected that non-existent TLD queries to Root DNS servers will
   decrease.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-fujiwara-dnsop-nsec-aggressiveuse/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-fujiwara-dnsop-nsec-aggressiveuse-03

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-fujiwara-dnsop-nsec-aggressiveuse-03

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: [email-masked]
Date: Thu, 24 Mar 2016 18:01:46 +0900 (JST)

Last week, Kato and I submitted -03 version of
draft-fujiwara-dnsop-nsec-aggressiveuse draft. It improved the
structure of the document for readability and made minor corrections
but essential idea has not been changed.

We are appreciated if you read and commet it.

Regards,

--
Kazunori Fujiwara, JPRS <[email-masked]>

> From: [email-masked]
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
>

---

From: Shane Kerr <[email-masked]>
Date: Thu, 24 Mar 2016 14:32:42 +0100

Fujiwara,

> but essential idea has not been changed.

Thank you for this work. I hope that it goes forward.

The latest draft seems to have spent a lot of time covering NSEC3 more
clearly.

My main question is... are there any missing pieces that you know of? It
seems pretty complete to me, although I have not implemented it so I
can't really say.

If there are not missing pieces, are there controversial parts?

Cheers,

--
Shane

---

From: [email-masked]
Date: Fri, 25 Mar 2016 19:45:55 +0900 (JST)

> From: Shane Kerr <[email-masked]>

Thanks,

> seems pretty complete to me, although I have not implemented it so I

(Implementation of NSEC3 aggressive negative caching is missing.)
(I would like to implement NSEC3 version)

> If there are not missing pieces, are there controversial parts?

There are some controversial parts.

  - Aggressive negative caching itself
  - The CD bit
  
If these parts will be agreed, I would like to go ahead.

Regards,