3 ms·
There are at least two more arguments against DNSSEC: 1) DNSSEC does materially make DDOS reflection attacks worse. djb has gone on about this at length, so I
by colmmacc 12y ago
There are at least two more arguments against DNSSEC:
1) DNSSEC does materially make DDOS reflection attacks worse. djb has gone on about this at length, so I won't.
2) DNSSEC also degrades a DNS server's ability to respond to requests. A regular non-DNSSEC DNS server can look up responses in O(1) time; see djb's TinyDNS for an example (it uses a CDB hash table to do it). A DNSSEC server must either use an ordered index to find "nearest match" for NSEC(3) ... and hence is O(log N), or it must sign the response on demand (which is against DNSSEC religion) and takes something like quadratic time.
It is a meaningful increase in both the computational and space complexities of serving a core infrastructural protocol - but for no meaningful benefit.
- ryanlol 12y ago1) Is not a valid argument, or at least shouldn't be. By that logic we should completely drop UDP.
- ryan-c 12y agoOn-the-fly signing (with "white lies") is also required to prevent enumeration of the zone.
- leni536 12y agoWell I'm sure that plain DNS look up responses are faster but I have been tought that that the difference between O(1) and O(log N) is really just theoretical and in practice the constant factor is typically more important. log N grows really slowly in the function of N.
- geocar 12y agoO-notation lacks utility. It isn't sufficient for a thorough analysis of the space/time complexity of algorithms, and profiling is much easier anyway. In this case: The constant coefficient in a DNS lookup is very small, whilst the constant coefficients in a DNSSEC response are very big.