Subject: please adopt http://tools.ietf.org/html/draft-vixie-dnsext-dns0x20

From: Paul Vixie <[email-masked]>
Date: Tue, 22 Jul 2008 19:00:00 +0000

please adopt http://tools.ietf.org/html/draft-vixie-dnsext-dns0x20 as a
working group document.  note that this technique was told to me by david
dagon fully three days before dan kaminsky told me about "the vulnerability"
and as such, there is no causal relationship between this document and those
events.  also note that i have been running this in production without any
errors or code changes for about the last four months.  finally, note that
Unbound also implements this feature, but hasn't enabled it by default (yet?)

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Brian Dickson <[email-masked]>
Date: Tue, 22 Jul 2008 15:28:29 -0400

> Unbound also implements this feature, but hasn't enabled it by default (yet?)
I have read the document and fully support its adoption as a WG item.
I encourage four others to do the same as fast as possible. ;-)

Brian Dickson

---

From: bert hubert <[email-masked]>
Date: Tue, 22 Jul 2008 21:37:55 +0200

> working group document.  note that this technique was told to me by david

I've been a bit quiet on this front - despite implementing dns0x20 myself.

dns0x20 does not add any entropy to queries involving domains with no alphabetical characters in them.

Like .

And it is exactly this . that is the grand prize.

	Bert

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://netherlabs.nl              Open and Closed source services

---

From: Paul Vixie <[email-masked]>
Date: Tue, 22 Jul 2008 22:07:32 +0000

> dns0x20 does not add any entropy to queries involving domains with no
> alphabetical characters in them.  > Like .  > And it is exactly this
> . that is the grand prize.

but not the only prize, and in most cases, too grand a prize.  but is this
a statement against adopting the document?  that is, do the merits of the
idea have to be uncontroversial at this stage?

---

From: Andrew Sullivan <[email-masked]>
Date: Tue, 22 Jul 2008 16:22:14 -0400

> dns0x20 does not add any entropy to queries involving domains with no alphabetical characters in them.

Is this an argument against adopting the draft as a WG item?  Note
that deciding the draft is a WG item does not entail that it will
eventually be sent on for publication -- the WG could decide that the
draft can't be made to work, or has fatal flaws, or something.

A

-- 
Andrew Sullivan
[email-masked]
+1 503 667 4564 x104
http://www.commandprompt.com/

---

From: "Roy Arends" <[email-masked]>
Date: Wed, 23 Jul 2008 00:31:04 +0200

> please adopt http://tools.ietf.org/html/draft-vixie-dnsext-dns0x20

I support this proposal.

Roy Arends
Nominet

---

From: Niall O'Reilly <[email-masked]>
Date: Wed, 23 Jul 2008 00:03:26 +0100

On Tue, 22 Jul 2008 20:00:00 +0100, Paul Vixie <[email-masked]> wrote:

> working group document.

	I have read the document and support the proposal to adopt
	it as a working group document.

	Niall O'Reilly

---

From: Alex Bligh <[email-masked]>
Date: Wed, 23 Jul 2008 00:13:49 +0100

> please adopt http://tools.ietf.org/html/draft-vixie-dnsext-dns0x20 as a

I have read and support this.

Re the root zone stuff, I think the fact it doesn't protect against one
attack (albeit an important one) does not mean that its potential in
protecting against others should be ignored. And at adoption for a w/g doc
stage, we are only looking for potential.

Alex

---

From: Ted Lemon <[email-masked]>
Date: Tue, 22 Jul 2008 16:31:14 -0700

On Jul 22, 2008, at 12:00 PM, Paul Vixie wrote:
> as a

I've read the draft and support its adoption as a working group  
document.

---

From: Joe Abley <[email-masked]>
Date: Tue, 22 Jul 2008 22:28:12 -0400

> please adopt http://tools.ietf.org/html/draft-vixie-dnsext-dns0x20  

I have read draft-vixie-dnsext-dns0x20 and support its adoption as a  
wg document. I would also volunteer to review future iterations of the  
document, if that seemed useful.

Joe

---

From: bert hubert <[email-masked]>
Date: Wed, 23 Jul 2008 08:14:41 +0200

> idea have to be uncontroversial at this stage?

Please standardise away - it is a nice hack. I assume you'll be changing
your domain to 'paulvixieonline.com' though! internetsoftwarecorporation.org
also has a nice ring to it.

I also note that 'com', which is just one lesser prize, has only 3 bits of
0x20 going for it. My favorite domain has just 2.

The merits appear to be surely not enough to warrant any 'MUST randomise
bit-0x20 in any query' language, though.

	Bert

---

From: Paul Vixie <[email-masked]>
Date: Wed, 23 Jul 2008 06:21:07 +0000

> bit-0x20 in any query' language, though.

i agree, but then i felt that udp port randomization should have remained
a BCP.  i'll be comfortable with whatever the WG decides wrt the standards
status (recommended vs. required) on dns-0x20.

---

From: bert hubert <[email-masked]>
Date: Wed, 23 Jul 2008 08:25:30 +0200

> Is this an argument against adopting the draft as a WG item?  Note

I don't mean it that way - it just does not strike me as something that will
get us very far. But do adopt - lots of people want to.

It was only years ago that 16 bits of additional random was claimed not to
matter in the least, whereas we are now discussing a proposal that adds 0
bits of random to very important queries.

Once you've "Kaminsky'd" the root, who cares about longer domains.

	Bert

---

From: Federico Lucifredi <[email-masked]>
Date: Wed, 23 Jul 2008 16:50:33 -0400

> Unbound also implements this feature, but hasn't enabled it by default (yet?)

I have reviewed  draft-vixie-dnsext-dns0x20 and support its adoption as 
a wg document.

I will also gladly review future revisions.

One comment on the current draft: 5.5 MAY want to reiterate explicitly 
that when not matching one of QUID, UDP Port number, question type or 
class, the responses is to be discarded but the server is not removed 
from SLIST.

A bit pedantic maybe, but right now the draft explicitly covers only the 
all-match except-name-mismatch case.

Best -F

-- 

_________________________________________
-- "'Problem' is a bleak word for challenge" - Richard Fish
(Federico L. Lucifredi) - [email-masked]

---

From: Peter Koch <[email-masked]>
Date: Mon, 28 Jul 2008 01:32:01 +0200

> working group document.  note that this technique was told to me by david

I have read draft-vixie-dnsext-dns0x20-00.txt.  I like the idea as a clever
engineering exercise (or "hack"), but I do not support this going on
standards track or BCP, because I fear the operational side effects.
Also, I think the WG should not rush through proposals in the light of
the so-called "Kaminsky attack", but should instead - after disclosure
allows - inspect and analyse the attack vectors to address the vulnerabilities
in particular.
However, the proposal appears to fit into the charter and dnsext is the right
venue to discuss it. Therefore I "support" the adoption. I'd also be
willing to review future revisions of the draft.

-Peter

---

From: Richard Johnson <[email-masked]>
Date: Mon, 28 Jul 2008 11:07:36 -0700

Yet another supporter...

/raj

---

From: Patrik Fältström <[email-masked]>
Date: Tue, 29 Jul 2008 08:05:25 +0100

> please adopt http://tools.ietf.org/html/draft-vixie-dnsext-dns0x20  

Yup, please do!

    Patrik

---

From: Ben Laurie <[email-masked]>
Date: Thu, 31 Jul 2008 05:04:48 +0100

> And it is exactly this . that is the grand prize.

I've got this great idea ... why not sign . ?

-- 
http://www.apache-ssl.org/ben.html           http://www.links.org/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

---

From: Bruce Campbell <[email-masked]>
Date: Fri, 1 Aug 2008 00:27:50 +1000 (EST)

> please adopt http://tools.ietf.org/html/draft-vixie-dnsext-dns0x20 as a

Yes, but with at least one change; section 5.4 implies that its a good 
idea to preserve the case of the original query in the reply from the 
resolver to the requesting application.  This needs to be a 'MUST' to 
avoid any issues with existing application libraries which already have 
expectations of case preservation, ie:

   5.4. Requestors MUST restore the case of the original question name
   after the successful verification of the 0x20 bits in the reply, before
   further decompression of the reply or forwarding onto a previous
   requestor in the chain.  This is to ensure that verification of 0x20
   bits by earlier requestors works as expected, and that any sections that
   use compression pointers which point into the question section are not
   contaminated by otherwise unexpected changes to 0x20 bits.

During the dnsext discussion, there was the comment from marcos in the 
jabber room to the effect that the 0x20 draft does not mention any 
interactions with DNSSEC.  This probably needs to be addressed in a 5.6. 
to the effect of 'A DNSSEC response shall be preferred over mismatches in 
the question section'.

--==--
Bruce.