Re: draft-ietf-dnsext-forgery-resilience-01.txt

[Danny Mayer <mayer@gis.net>]

Stephane Bortzmeyer wrote:
> On Mon, Nov 12, 2007 at 11:03:44PM +0100,
>  bert hubert <bert.hubert@netherlabs.nl> wrote 
>  a message of 34 lines which said:
> 
>>   Implementations MUST use Query-IDs that are hard to predict
> 
> More detailed, with the help of Alex Bligh:
> 
> Implementations MUST use Query-IDs that are hard to predict for a
> third party with access to wire data. This could, for instance, be
> achieved by introducing a random [RFC 4086] or pseudo-random component
> into the mechanism used to select the ID
> 
> --
> Read on /., about MS-Windows error messages:
> 
> Your system must meet the requirements to be able to run the Windows
> Random Number Generator on Vista. Otherwise, you will need to use
> Windows Number Generator Basic. The only number WNGB can generate is
> 4.

You can use CryptGenRandom() on Windows if you want a good random number
generator. However, none of this has anything to do with the question on
Query-IDs and is at a level of detail that the implementor would be
dealing with.

Danny

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>