Subject: [saag] review request, draft-jvcelak-nsec5-00

From: Jan Včelák <[email-masked]>
Date: Tue, 10 Mar 2015 17:29:25 +0100

Hello list,

me and Sharon Goldberg put together the attached draft. We are looking for 
feedback from people with security and DNS expertise. We are particularly 
interested in your opinions on the transition mechanisms and the extent of the 
required protocol modifications.

We will have a short presentation of the draft in Dallas. So I'll be happy to 
answer any questions here, or we can talk in person later.

Links:

   https://devpub.labs.nic.cz/jvcelak/nsec5/draft-jvcelak-nsec5-00.txt
   https://devpub.labs.nic.cz/jvcelak/nsec5/draft-jvcelak-nsec5-00.html
   https://devpub.labs.nic.cz/jvcelak/nsec5/draft-jvcelak-nsec5-00.xml

Abstract

   The Domain Name System Security (DNSSEC) Extensions introduced the
   NSEC resource record (RR) for authenticated denial of existence and
   the NSEC3 for hashed authenticated denial of existence.  The NSEC RR
   allows for the entire zone contents to be enumerated if a server is
   queried for carefully chosen domain names; N queries suffice to
   enumerate a zone containing N names.  The NSEC3 RR adds domain-name
   hashing, which makes the zone enumeration harder, but not impossible.
   This document introduces NSEC5, which provides an cryptographically-
   proven mechanism that prevents zone enumeration.  NSEC5 has the
   additional advantage of not requiring private zone-signing keys to be
   present on all authoritative servers for the zone.

Best regards,

Jan

---

From: Jan Včelák <[email-masked]>
Date: Mon, 23 Mar 2015 16:05:05 +0100

Hello list,

I just submitted the draft into the data tracker:

http://datatracker.ietf.org/doc/draft-vcelak-nsec5/

Regards,

Jan