Subject: Re: Is this a possible DoS scenario within DNSSEC ?

From: bill <[email-masked]>
Date: Tue, 08 Aug 2000 19:44:40 -0400

Ted Lindgreen responds to Ogud:

> > servers will increase significantly. And DNSSEC may not work well if
> > resolvers are stuck behind a non DNSSEC capable forwarder.
> 
> Absolutely, and the real lessons are therefore clear:
> - Secure aware resolvers should not use non secure aware
>   caching servers as forwarder.

	So, how do secure aware resolvers identify a non-secure
	aware caching server? Once they can id the suspect cache
	how are they to "remember" that the cache is suspect?

	And perhaps more importantly, is this on a machine or 
	zone basis?  If per zone, then there is the temporal issue,
	i.e. when does the zone "flip" between secure and not and
	how does the caching server "keep" up?

--bill

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Olafur Gudmundsson <[email-masked]>
Date: Tue, 22 Aug 2000 14:59:12 -0400

>         how does the caching server "keep" up?

The answer is in the draft that David Conrad is writing on and EDNS0 flag.
David where is the draft ?

         Olafur

---

From: "David R. Conrad" <[email-masked]>
Date: Thu, 24 Aug 2000 09:54:07 -0700

Olafur,

>>         aware caching server? 

Err, no.  The draft I'm writing addresses the question of how a server
knows it is worthwhile to send DNSSEC data back to a client.  

If I understand the question, one answer could be that it is the
responsibility of the user (system admin) to insure that the cache the
resolver points to is DNSSEC aware.  But I probably don't understand the
question.

> David where is the draft ?

Like BINDv9, coming RSN... :-).  More seriously, hope to get it out on
Monday.

Rgds,
-drc