Re: Authenticated denial of existence...

[ Quoting <[email protected]> in "Re: [dnsext] Authenticated denial o..." ]
> 
> good writing of this draft.
> 
> I am interested the following text in section 3:
> "   2.  The DNS packet header is not signed.  This means that a "status:
>        NXDOMAIN" can not be trusted.  In fact the entire header may be
>        forged, including the AD bit (AD stands for Authentic Data, see
>        RFC 3655 [RFC3655]), which may give some food for thought;
> "
> so if the resolver is attacked, such as hacking the "status" field or the whole header, what will happen?

A good resolver should check the complete message and then header so see if they
match. Of course this only works if the message contains signatures. 

Should we add something along these lines to the draft. Currently it is an
"exercise for the reader", which I kinda like.

Regards,
Miek
_______________________________________________
dnsext mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/dnsext