Re: draft-ietf-dnsext-forgery-resilience-01.txt

[Stephane Bortzmeyer <bortzmeyer@nic.fr>]

On Mon, Nov 12, 2007 at 02:57:51PM +0000,
 Paul Vixie <paul@vix.com> wrote 
 a message of 24 lines which said:

> there's no consensus that even a ~31 bit pseudo random combination
> of source port and query ID is good enough to have confidence that
> any given answer was really received from a purported server.

As mentioned by Bert, we do not try to achieve the same result as
DNSSEC. We try to raise the bar for the attacker. A sort of
Better-Than-Nothing security.

> there is also no consensus on the meaning of "good" in the context
> of "good random source".  some say arc4random is fine, others say
> it's too weak.

Hence the idea to delegate the whole point to RFC 4086, which is
already written.


--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>