Re: IPv6 root DNS change

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Stuart D. Gathman wrote:
> On Fri, 4 Jan 2008, Julian Mehnle wrote:
> > > http://www.icann.org/committees/security/sac018.pdf
> >
> > Can you be more specific about what sort of bugs might occur?
>
> The above PDF is specific.

Certainly, but I scanned the document briefly and it didn't occur to me 
how any of it would affect SPF implementations directly.

> 1. The new root DNS packets will be 811 bytes (13 A, 13 AAAA records),
> UDP only.  This requires EDNS0 support.
> [...]
> A thought: Issue 1 says to me that SPF DNS packets ought to be allowed
> to be as big as DNS root packets.  So the minimum SPF packet size
> should be increased to 811 from 512.

I can't think of why SPF implementations would be concerned with root 
server list priming.  Besides, the only place where RFC 4408 is 
explicitly mentioning the 512 bytes limit is in section 3.1.4, "record 
size", saying that SPF records should be designed to stay below that 
limit, which is an entirely different issue.

Do you think that any SPF implementations enforce a 512 bytes limit in 
some context affected by the use of IPv6 (addresses)?

> 2. Security software might block DNS records with unknown record types,
> and might not know about AAAA.

OK, so checking SPF for incoming IPv6 connections might fail.  But that 
possibility has existed for years now, and there's nothing an SPF 
implementation can do about it, is there?

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHfmHVwL7PKlBZWjsRAvtQAJ9TijiLStec62JBu7anYIlJ9wuybgCcDlgB
QnDudFJyv4lVYEmvQXVoRog=
=8Ltd
-----END PGP SIGNATURE-----

-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Archives: http://v2.listbox.com/member/archive/1007/=now
RSS Feed: http://v2.listbox.com/member/archive/rss/1007/
Modify Your Subscription: http://v2.listbox.com/member/?member_id=6959932&id_secret=81837435-a3f7c1
Powered by Listbox: http://www.listbox.com