Subject: RE: Proposal to fix NSEC

From: "Sal Mangiapane" <[email-masked]>
Date: Thu, 20 May 2004 12:36:51 -0400

> Peter Koch <[email-masked]> writes:
>
> > Bob Halley <[email-masked]> wrote:
> >
> >> The problems with online signing are:
> >>
> >>         It's a CPU burden for the authoritative nameserver.
> >
> > Yes, but the operators in question (TLD registries) should be able to deal
> > with this.
>
> I don't think you understand what level of CPU burden online signing
> can be in the face of unauthenticated queries.  It's a DoS attack
> waiting to happen.  Turn this "feature" on in your DNS servers and I
> can bring your server to its knees without even trying.  It's very
> simple: I send a string of random requests to your server for random
> (non-existent) hosts in your authoritative zone.  To make sure you
> can't block this easily at your firewall I spoof the sender address (I
> don't care about the responses anyways).
>
> Even if modern TLD CPUs can handle 10,000 RSA encryptions per second
> (my laptop tops out at around 2,000 with full-bore CPU usage), that
> just means I need to send you 10,000 requests per second.  That's
> about 10mbps (probably even less).  Not too hard to achieve.  Note
> that my 2000/s is full-CPU.  You need a good deal of CPU to actually
> perform the DNS query/response, so that reduces the number of actual
> RSA operations possible.
>
> The problem is that it's just too prone to DoS attacks....  Which is BAD.

A standard could be established to help thwart DoS attack.

1) Only use signatures for queries from named name servers (ns record exists).
2) Only use signatures when the named name server uses signatures (it signed the request).
3) When your server load exceeds a predefined limit (like 30% CPU) drop all query requests from unknown name servers (such as
caching name servers).
4) When your server load exceeds some next higher limit (like 50% CPU) drop all query requests except when signed from a named name
server.

This methodology will also encourage adoption of the new standard for obvious reasons.

Of course,
1) could easily be spoofed.
2) could not, but may tie up your DNS server verifying signatures.

Best Regards,

Sal

Salvatore Mangiapane

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Peter Koch <[email-masked]>
Date: Fri, 21 May 2004 17:32:13 +0200

> just means I need to send you 10,000 requests per second.  That's

you're right that expensive responses ease DoS, but the potential is there
already. Even without malicious intent one would want to evaluate the
current NXDOMAIN/referral ratio to estimate the resources needed under
"normal" operations. Shouldn't be as bad as for the root servers.
For reaction to DoS it was already suggested to start dropping answers
if the number of NXDOMAIN responses grow over a certain threshold.

> The problem is that it's just too prone to DoS attacks....  Which is BAD.

I'm not saying it's easy.

-Peter