Subject: [DNSOP] I-D Action: draft-ietf-dnsop-nsec-aggressiveuse-02.txt

From: [email-masked]
Date: Tue, 13 Sep 2016 08:28:03 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Domain Name System Operations of the IETF.

        Title           : Aggressive use of NSEC/NSEC3
        Authors         : Kazunori Fujiwara
                          Akira Kato
                          Warren Kumari
	Filename        : draft-ietf-dnsop-nsec-aggressiveuse-02.txt
	Pages           : 13
	Date            : 2016-09-13

Abstract:
   The DNS relies upon caching to scale; however, the cache lookup
   generally requires an exact match.  This document specifies the use
   of NSEC/NSEC3 resource records to generate negative answers within a
   range.  This increases performance / decreases latency, decreases
   resource utilization on both authoritative and recursive servers, and
   also increases privacy.  It may also help increase resilience to
   certain DoS attacks in some circumstances.

   This document updates RFC4035 by allowing resolvers to generate
   negative answers based upon NSEC/NSEC3 records.

   [ Ed note: Text inside square brackets ([]) is additional background
   information, answers to frequently asked questions, general musings,
   etc.  They will be removed before publication.This document is being
   collaborated on in Github at: https://github.com/wkumari/draft-ietf-
   dnsop-nsec-aggressiveuse.  The most recent version of the document,
   open issues, etc should all be available here.  The authors
   (gratefully) accept pull requests.

   Known / open issues [To be moved to Github issue tracker]:

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-dnsop-nsec-aggressiveuse/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-dnsop-nsec-aggressiveuse-02

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-dnsop-nsec-aggressiveuse-02

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Warren Kumari <[email-masked]>
Date: Tue, 13 Sep 2016 12:03:55 -0400

Hi all,

The authors have attempted to integrate / incorporate all comments received.

One of the main changes was suggested by Jinmei ("we might want to
follow the style of draft-ietf-dnsop-nxdomain-cut-04."), and resulted
in Section 6 - Benefits.

I'd really appreciate a review of this section, especially the last 2
paragraphs (starting with):
"[ Editor note: There has been some discussion on if this document
   should discuss this attack and mitigation.  The authors think that
   this is useful / important, but some participants feel that it
   oversells the DoS mitigation benefit.  Please let us know if the
   below is helpful.  Also, the below description is not as clear as it
   could be - it's been tricky to balance readability, correctness and
   conciseness.  Text gratefully accepted... ]"

W

On Tue, Sep 13, 2016 at 11:28 AM,  <[email-masked]> wrote:
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop

-- 
I don't think the execution is relevant when it was obviously a bad
idea in the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair
of pants.
   ---maf

---

From: "Paul Hoffman" <[email-masked]>
Date: Tue, 13 Sep 2016 10:30:39 -0700

> The authors have attempted to integrate / incorporate all comments 

...and the draft is looking really good now.

> follow the style of draft-ietf-dnsop-nxdomain-cut-04."), and resulted

It's nice to have it there in one place.

>    conciseness.  Text gratefully accepted... ]"

Discussions of DoS attacks and mitigations get bogged down quickly; see, 
for example, the past year or two in the IPsecME WG. It is safe to 
assume that if a method prevents a type of DoS attack, attackers will 
find another way to mount the attack. The current wording describes one 
type of attack, and how this helps mitigate it. That's sufficient: you 
don't need to say "and therefore you SHOULD use this method to avoid 
attacks".

--Paul Hoffman

---

From: Warren Kumari <[email-masked]>
Date: Tue, 13 Sep 2016 13:51:55 -0400

> ...and the draft is looking really good now.

Thank you - it's always nice to get positive feedback.

> It's nice to have it there in one place.

Yup, I really liked that suggestion - thanks to Jinmei for suggesting
this, and Stephane, Shumon for draft-ietf-dnsop-nxdomain-cut-04.

> Discussions of DoS attacks and mitigations get bogged down quickly; see, for
> example, the past year or two in the IPsecME WG. It is safe to assume that
> if a method prevents a type of DoS attack, attackers will find another way
> to mount the attack. The current wording describes one type of attack, and
> how this helps mitigate it. That's sufficient: you don't need to say "and
> therefore you SHOULD use this method to avoid attacks".

Thank you.
W

---

From: Bob Harold <[email-masked]>
Date: Tue, 13 Sep 2016 15:50:20 -0400

On Tue, Sep 13, 2016 at 11:28 AM, <[email-masked]> wrote:

> Looks good, but this one sentence in  "5.4. Wildcard" does not read well
to me:

"But, it will be more
effective when both are enabled since the resolver can determine the
name subject to wildcard would not otherwise exist more efficiently."

Not sure how to reword it.

-- 
Bob Harold