Re: Proposal to fix NSEC

[Chris Thompson <cet1@cus.cam.ac.uk>]

ben@algroup.co.uk (Ben Laurie) writes:
[...]
> I actually am still of the view that if nameservers suddenly started 
> returning NSEC2 instead of NSEC things would work as desired: namely old 
> resolvers would suddenly get protocol errors instead of NXDOMAIN, and 
> new resolvers would just work.
> 
> If this causes bad things to happen, then DNSSECbis is already broken, 
> since an attacker can clearly cause NSEC records to be corrupt.

Define "bad". DNSSEC has never been proof against DoS attacks that make 
it unable to answer questions (as opposed to answer them incorrectly).
That doesn't mean that a protocol change that would simulate the effect
of a DoS attack would be a desirable thing to advocate.

Chris Thompson
Email: cet1@cam.ac.uk

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>