Re: OPENPGPKEY RRTYPE review - Comments period ends Aug 6th

Nicholas Weaver <[email protected]> Thu, 24 Jul 2014 09:38:10 -0700

Newsgroups	gmane.ietf.dnsext
Message-ID	<[email protected]>

On Jul 24, 2014, at 9:18 AM, Joe Abley <[email protected]> wrote:

> 
> 
> On 23 July 2014 at 23:10:21, Jay Daley ([email protected]) wrote:
> 
>> I see Joe has provided one reason (which doesn't appear to make sense to me since a large  
>> RRType can't be 'hidden' lower down),
> 
> I was referring to the ongoing habit of choosing an apex QNAME and using QTYPE=ANY in a reflection attack; the more stuff you load into the apex owner name, the bigger the amplifier. From that perspective the more apex-related stuff you can shift to sub-layers, the worse the amplifier, the better the Internet.

Attackers can (and have in the past) created their own domain that serves a very cacheable, arbitrarily-large response.

--
Nicholas Weaver                  it is a tale, told by an idiot,
[email protected]                full of sound and fury,
510-666-2903                                 .signifying nothing
PGP: http://www1.icsi.berkeley.edu/~nweaver/data/nweaver_pub.asc

_______________________________________________
dnsext mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/dnsext

signature.asc (application/pgp-signature, 841 B)