Re: draft-ietf-dnsext-forgery-resilience-01.txt

[Shane Kerr <Shane_Kerr@isc.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Florian Weimer wrote:
> * Tony Finch:
> 
>> On Mon, 12 Nov 2007, Florian Weimer wrote:
>>> * Stephane Bortzmeyer:
>>>> What is not a good idea? "Implementations SHOULD use good random
>>>> source to select a Query ID" or "The draft should add a reference to
>>>> RFC 4086"?
>>> The former.  It has been argued that non-repeating query IDs are more
>>> important than good randomness.  I tried very hard to understand this,
>>> but I still don't get it.
>> You can't just naively pick a query ID at random from the whole 16 bit
>> space because you'll have ID clashes.
> 
> Why are ID clashes a problem?  Do real-world authoritative servers
> misbehave when confronted with them?

Well, it's a resolver that picks the query ID, but this is a good question.

The only time you have an actual clash is when you have a duplicate ID+source
IP+source port+destination IP+destination port for a UDP query, because then the
resolver has no way to disambiguate the replies it gets.

Certainly some implementations may have problems with duplicate query IDs, but
that's out of scope for an RFC, IMHO.

- --
Shane
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHOIoXMsfZxBO4kbQRAq+jAJ4y4C3h9Yxjhftdtv7dlUDNypTtmACeI2qw
NZxccHl/WUSWJ/tnS0dfaJE=
=K5Hn
-----END PGP SIGNATURE-----

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>