4 ms·
>DDoS amplification vector. How would a TLS-using protocol be used as a DDoS amplification vector? >If you give an address that always sends back ICMP unreach
by zaarn 8y ago
>DDoS amplification vector.
How would a TLS-using protocol be used as a DDoS amplification vector?
>If you give an address that always sends back ICMP unreachable messages, the client fails immediately and continues to load the rest of the page, but DNSSEC proscribes that.
You can return resolver errors or no data, there is plenty of options for DNS blackholing.
>There are also circumstances where you want to return a specific address, e.g. so that attempts to send traffic to that address can be monitored, and redirecting the address doesn't work because it could be a shared host using SNI and you don't want to affect every name pointing to that address.
You'll need a PKI for that anyway so you can deploy DNSSEC root keys.
- zrm 8y ago> How would a TLS-using protocol be used as a DDoS amplification vector? Turning off UDP DNS would break everything that still uses it but adding the DNSSEC records makes the UDP responses a DDoS amplification vector even if some clients use TLS. > You can return resolver errors or no data, there is plenty of options for DNS blackholing. DNSSEC validates NODATA responses and clients can respond to resolver errors in various ways that amount to more timeouts. > You'll need a PKI for that anyway so you can deploy DNSSEC root keys. That's assuming you want to MitM the connection rather than merely log the attempt before dropping it or record it for traffic analysis even if you can't MitM it.