Re: issues with draft-ietf-dnsext-dnssec-trans-00.txt

[Greg Hudson <ghudson@MIT.EDU>]

On Mon, 2004-06-14 at 16:57, Paul Vixie wrote:
> if you want non-authenticated denial, maybe you should just leave out
> the NSEC altogether.

I think at that point you may as well not answer the question.  If your
zone has a key, an unsigned response looks like an attack, and should be
discarded.

I kind of like the deny-the-whole-zone NSEC response, personally.  The
denial replay attack seems like a relatively mild practical
consequence.  (Of course, I think it's much better to have real NSEC
records and a zone file available for FTP, and I think most of the
arguments against doing that are horribly off the mark, but I'm willing
to take it as axiomatic that some zones will find denying enumeration
more important than having good security against spoofing attacks.)


--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>