Subject: Re: (in)Security Analysis and Catastrophically bad Design: Re: [dnsext] DNSCurve Internet-Draft (fwd)

From: Nicholas Weaver <[email-masked]>
Date: Thu, 4 Mar 2010 09:53:26 -0800

On Mar 4, 2010, at 9:30 AM, Dean Anderson wrote:
> An important difference between DNSCurve and DNSSEC is that DNSSEC also
> enables a new and serious DDOS attack (as I described previously), while
> I don't think DNSCurve can be so similarly abused.  There are several
> more flaws in DNSSEC that aren't shared by DNSCurve. (previously 
> described)

Actually, this is a myth: There are enough open recursive resolvers, and enough ability to choose names to query for these, that DNSSEC is NOT needed to produce huge amplification for a spoofed-source reflector attack.

EG, "find the open resolver's maximum MTU, then do queries which are guarenteed to send that maximum MTU", such as "pad_xxx.myevildomain.com".

And there are enough similar names that you can find those without even needing to set up a "malicious" authority.  

DNSSEC makes these names easier to find, but just because the suitable names are a little harder to find does not mean that DNSSEC actually makes the spoofed reflector attack worse.  

It was the enabling of 4096B responses in DNS, not DNSSEC, that allows these attacks to increase the traffic per packet by 8x.

As it should be clear, I'm really not a fan of DNSSEC either, but the spoofed-source DOS attack issue is, IMO, a red herring.

> Particularly amusing given recent discussion on this list is the
> exclamation by Weaver: "yes, we've seen ISPs MitM www.google.com in
> DNS!"  The ISP doing this is actually OpenDNS, Dempsky's employer.  Of
> course, even with DNSSEC, the recursor can still "MitM" lookups very
> simply by not implementing DNSSEC.  Since both proposals share this
> defect (if it is one), it is unfair to criticize only one for this
> alleged defect.  Seems there is a saying here that is revelant;  
> something about a speck of dust vs a log in an eye that is relevant...

Actually, the MitM is Wide Open West and some others.  These were detailed in our written material to the FCC, and in an upcoming in-submission paper.  We have not been able to successfully contact these network operators to find an explanation

OpenDNS has many more issues, which I will not go into in this forum, but it is NOT OpenDNS's behavior that I'm referring to, as OpenDNS is explicit consent of the user to muck with the user's DNS (except in the case of hotspots etc which use OpenDNS).

But DNSSEC really is diametrically opposed to OpenDNS's business model, so their opposition to DNSSEC is understandable.

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 4 Mar 2010 17:36:40 -0500

Dear colleagues,

Please remember to check your headers when writing to the list.  Large
numbers of cc:s should not be necessary.  I also ask posters not to
cc: the "namedroppers-honest" list if they're going to post to
namedroppers.  If you want to post to a different list with different
posting rules, please post there and not here.

Best regards,

Andrew (moderator hat on).

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.