Re: draft-ietf-dnsext-forgery-resilience-01.txt

[bert hubert <bert.hubert@netherlabs.nl>]

On Fri, Nov 16, 2007 at 12:52:37PM -0200, Stephane Bortzmeyer wrote:
> New version that I propose, with a clearer separation between the norm
> and the rationale (they could even be placed in different sections). I
> believe this captures the discussion in the WG and that nothing was
> forgotten.
> 
> 
> Rule:
> 
> Implementations MUST use Query-IDs that are hard to predict for a
> third party, even if this third party has access to previous wire
> data.

I like it a lot.

> Advice for implementors:
> 
> "Hard to predict" Query-IDs could, for instance, be achieved by
> introducing a random [RFC 4086] or pseudo-random component into the

This could be put in chapter 10, 'rationale' perhaps.

Thanks!

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://netherlabs.nl              Open and Closed source services

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>