Re: [DNSOP] Re: NSEC++ (Was: Re: DNSEXT Minutes @ IETF-63)

[Joe Abley <jabley@ca.afilias.info>]

On 8-Nov-2007, at 23:36, Dean Anderson wrote:

> NSEC3 is meant to protect against disclosure of DNS data (a topic
> discussed).

I don't think so. NSEC3 is intended to prevent enumeration of the  
resource records in a zone by a remote third party. That's not the  
same thing.

For example, even if a zone contained NSEC3 records, it's still  
perfectly possible for DNS data to be disclosed to parties who are not  
the originator of a client query (e.g. through traffic intercept,  
query logs on intermediate caches, etc.)


Joe


--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>