Subject: Re: dictionary attack on nameservers

From: Alex Bligh <[email-masked]>
Date: Thu, 29 Jul 2004 22:27:34 +0100

--On 29 July 2004 20:57 +0100 Jim Reid <[email-masked]> wrote:

> I'm not sure that either is the case. Dictionary attacks will mean
> zone enumeration is always successful, if not always complete.

A successful but necessarily incomplete zone enumeration is in my book an
oxymoron. I am pointing that out not as a cheap shot, but because
enumeration (at least in my book and I think that of those with the
enumeration problem) means the ability to gain a complete or an almost
complete zone through iteration, and we might as well each try and
understand what terminology the other is using.

I do not think there is any dispute that it is possible (without even
having access to nameservers for the the zone) to get a list of domains, a
substantial number of which will be in the zonefile, with that set itself
representing a material portion of the zonefile, for many (but not all)
zonefiles, whether that's by dictionary attack or by textual search of
referring entities (web pages / in-addr.arpa). But that does not equate to
enumeration which (using our terminology) is
a) complete (or very nearly so); and
b) sourced by the organization serving the zone

Seems to me there is a lot of argument here backed by little hard data.
It would be good if (without trashing an xTLDs nameservers) there was
some statistical evidence of what % accuracy/completeness a proposed
attack gave. Let me suggest:

  Accuracy% = 100 * ( [PositivelyDiscoveredEntries] - [FalsePositives])
                    ---------------------------------------------------
                                    TotalEntries

as a metric.

Let's bear in mind NSEC as is is 100% assuming an enumeration can be done
between zone updates.

Alex

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Olaf M. Kolkman" <[email-masked]>
Date: Fri, 30 Jul 2004 07:19:25 +0200

Dear Colleagues

Lets stop going around in circles.

- We all know that enumerating zone data is possible today. Your millage 
may vary.
- We all know that NSEC walking will provide you with all names in a zone.

But I do not know what the threat is we try to protect against.

This working group will need to get the requirements for making informed 
decisions on how to design NSEC++.  Remember that Rip and Ben have 
volunteered to put such a list together. Please send your requirements 
to these to friendly volunteers.  If you have a threat model in mind, 
please document and send to Ben &  Rip.

(http://ops.ietf.org/lists/namedroppers/namedroppers.2004/msg01237.html)

Once we have these requirements we can start engineering and figure out 
_if_ we can find a solution that meets these requirements. Work that 
Miek started may help to make an analysis of the requirements.

Please try to phrase what NSEC++ is expected to deliver and mail your 
comments to Ben and Rip.

--Olaf
   DNSEXT Co-Chair.