Security comments re draft-ietf-dnsext-unknown-rrs-00.txt

[Dennis Glatting <dennis.glatting@software-munitions.com>]

One problem I have with this draft is blind Kashpureff attacks. One of
the reasons Kashpureff was successful is that implementations didn't
check returned data very hard, rather they simply cached it and passed
it on later. What this draft does, I believe, and regardless of
DNSsec, is make this kind of attack trivial again.

Additionally, I can imagine a cleverly crafted unknown RR type that
tickles an resolver implementation error, such as a buffer overrun or
an off-by-one error, for a given set of clients, such as a particular
unpatched version of Microsoft NT. Since a server simply passes data
on, then you have no hope of distinguishing between proper data and
bad data and protecting clients.


to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.