5 ms·

How does this validate DJB's criticism? He's saying we shouldn't adopt DNSSEC because of traffic amplification. But we're already in an untenable situation with

by morsch 14y ago

How does this validate DJB's criticism? He's saying we shouldn't adopt DNSSEC because of traffic amplification. But we're already in an untenable situation with the amplification caused by bog standard DNS -- according to your quote, it's even worse than DNSSEC -- so we need to solve the problem anyway.

tptacek 14y ago
I am batting .000 on analysis for this situation and debated removing the comment and just replacing it with a link to DJB's talk. We don't have all the details but there's a notion that the attack already implicates DNSSEC because of RIPE's RRSIG records. I don't know, either way.
- morsch 14y ago
  OK. I was present at djb's CCC talk and also heard Dan Kaminsky's rebuttal, hence my interest. A link to DNSSEC would be interesting if not hing else.
- davidu 14y ago
  Correct. DNSSEC just makes amplification worse. It's like: Do you want to be shot with 50 bullets or 100 bullets. DNSSEC is 100 bullets, regular DNS might be 50 bullets. Either way, you're going to die. I don't like DNSSEC, but amplification isn't my argument against it. The fact that it doesn't provide encryption, puts keys in the wrong hands, and is bizarrely complex for reasons that don't fit with the model of DNS is why I don't like DNSSEC.
  - floody-berry 14y ago
    DNSSEC amplification is still pretty high. When I ran dnssecamp[1] last year, I got similar numbers to the example run cited (2000+ servers providing 30x amplification, scaling up to 95x amplification for the worst offenders). [1] http://dnscurve.org/dnssecamp.html http://dnscurve.org/dnssecamp.html
- marshray 14y ago
  I think what it means is that if we're going to deploy DNSSEC, we might as well give up this fruitless war on "open resolvers*" and focus our energies on other solutions. Substitute 'routers' for 'resolvers' to see how this only plays into the hands of those who don't like the openness of the internet.

by morsch 14y ago

tptacek 14y ago

I am batting .000 on analysis for this situation and debated removing the comment and just replacing it with a link to DJB's talk. We don't have all the details but there's a notion that the attack already implicates DNSSEC because of RIPE's RRSIG records. I don't know, either way.

morsch 14y ago
OK. I was present at djb's CCC talk and also heard Dan Kaminsky's rebuttal, hence my interest. A link to DNSSEC would be interesting if not hing else.
davidu 14y ago
Correct. DNSSEC just makes amplification worse. It's like: Do you want to be shot with 50 bullets or 100 bullets. DNSSEC is 100 bullets, regular DNS might be 50 bullets. Either way, you're going to die. I don't like DNSSEC, but amplification isn't my argument against it. The fact that it doesn't provide encryption, puts keys in the wrong hands, and is bizarrely complex for reasons that don't fit with the model of DNS is why I don't like DNSSEC.
- floody-berry 14y ago
  DNSSEC amplification is still pretty high. When I ran dnssecamp[1] last year, I got similar numbers to the example run cited (2000+ servers providing 30x amplification, scaling up to 95x amplification for the worst offenders). [1] http://dnscurve.org/dnssecamp.html http://dnscurve.org/dnssecamp.html
marshray 14y ago
I think what it means is that if we're going to deploy DNSSEC, we might as well give up this fruitless war on "open resolvers*" and focus our energies on other solutions. Substitute 'routers' for 'resolvers' to see how this only plays into the hands of those who don't like the openness of the internet.