4 ms·
Hmm. What I got was that, disregarding the open redirector thing, DNSSEC is typically "only" about two times worse than regular DNS amplification. DJB's number
by morsch 14y ago
Hmm. What I got was that, disregarding the open redirector thing, DNSSEC is typically "only" about two times worse than regular DNS amplification. DJB's number is a lot higher.
- tptacek 14y agoFirst, Bernstein is talking about servers, and Kaminsky is shifting the goalposts to caches. Second, you can compare their numbers directly (get Bernstein's from any of his DNS talks at cr.yp.to). Third, read closely and you run into things in Kaminsky's post like this: That’s a 3.6KB response to a 64 byte request, no DNSSEC required. I’ve been saying this for a while: DNSSEC is just DNS with signatures. Whose bug is it anyway? Well, at least some of those servers are running DJB’s dnscache… Well, probably not, because dnscache was, from the time of its release, the first cache server to ship default-deny for remote queries; if you want dnscache to serve as an open cache, you have to jump through hoops to configure it that way. Most open cache servers are BIND.