3 ms·
Kaminsky on DNSSEC amplification: http://dankaminsky.com/2011/01/05/djb-ccc/#dnsamp http://dankaminsky.com/2011/01/05/djb-ccc/#dnsamp He doesn't think it's a v
by morsch 14y ago
Kaminsky on DNSSEC amplification: http://dankaminsky.com/2011/01/05/djb-ccc/#dnsamp http://dankaminsky.com/2011/01/05/djb-ccc/#dnsamp
He doesn't think it's a very strong argument against DNSSEC.
- tptacek 14y agoThis post doesn't actually say anything. It says that DNSSEC amplification is a known attack --- nobody is suggesting Bernstein "invented it" --- and that there are other amplification vectors besides DNSSEC. The latter point would be compelling if those vectors were as powerful as DNSSEC, but they aren't. The notion that the problem is "actually open redirectors" (nameservers configured to answer queries from arbitrary points on the Internet) is indicative of the weird reasoning that the IETF DNS people have used all throughout the DNSSEC process. Open redirectors means DNSSEC is a viable mechanism to get ISPs to flood random sites off the Internet? Just mandate that ISPs not run DNSSEC that way! Secret DNS names mean that verified negative answers in the DNSSEC protocol will breach confidentiality? Just mandate that nobody have secret DNS names! Daniel J. Bernstein did a much more convincing takedown of dakami's reasoning in a talk at 27C3; I'm not going to recap it. I'd just say Daniel J. Bernstein has earned the authority he speaks with regarding DNS security; the vulnerability dakami is famous for discovering is one that djbdns --- released many years before that vulnerability was disclosed --- was designed in part to address. Obviously (if you've ever installed djbdns), Bernstein did a good job of handling the open redirector problem as well. Kaminsky got on the wrong side of this issue, which is ironic, because he's put a lot more time into practical DNS security than the people he's arguing on behalf of.
- morsch 14y agoHmm. What I got was that, disregarding the open redirector thing, DNSSEC is typically "only" about two times worse than regular DNS amplification. DJB's number is a lot higher.
- tptacek 14y agoFirst, Bernstein is talking about servers, and Kaminsky is shifting the goalposts to caches. Second, you can compare their numbers directly (get Bernstein's from any of his DNS talks at cr.yp.to). Third, read closely and you run into things in Kaminsky's post like this: That’s a 3.6KB response to a 64 byte request, no DNSSEC required. I’ve been saying this for a while: DNSSEC is just DNS with signatures. Whose bug is it anyway? Well, at least some of those servers are running DJB’s dnscache… Well, probably not, because dnscache was, from the time of its release, the first cache server to ship default-deny for remote queries; if you want dnscache to serve as an open cache, you have to jump through hoops to configure it that way. Most open cache servers are BIND.
- mike-cardwell 14y agoI advise people to read the blog post linked to be morsch as it says a lot more than tptacek claims.
- tptacek 14y agoI am exclusively responding to the part of Kaminsky's post that discusses amplification. Please don't make a straw man argument that I've dismissed the whole thing based on his handling of amplification; I can do a better job of being dismissive of it than that. I agree with very little of what Kaminsky has to say about DNSSEC, but my arguments are reasoned well enough that I'm not afraid to actually make them.
- mike-cardwell 14y agoThen you shouldn't have a problem with people reading it, as I advised.
- tptacek 14y agoThe hell? Who said I have a problem with people reading anything? How does that even make sense?
- mike-cardwell 14y agoNobody. Nobody said that.