Subject: Re: dictionary attack on nameservers

From: Jim Reid <[email-masked]>
Date: Thu, 29 Jul 2004 19:08:15 +0100

>>>>> "Jay" == Jay Daley <[email-masked]> writes:

    Jay> When people register a name they use a name from a pool of
    Jay> possible names.  As a zone grows in size people begin to
    Jay> exhaust the easy pools and so need to invent new pools.  So
    Jay> the initial pools are often

    Jay>         very short names (2, 3, 4 characters) 
    Jay>	 generic words (eg music, buses, teeth)
    Jay>	  organisation/personal names
 
    Jay> but as these grow people start to invent new ones

    Jay>         generic hyphen generic 
    Jay>         generic plus number

    Jay> and so on.

    Jay> So the smaller a zone is, the easier it is to enumerate. 

Nope. The smaller the zone, the easier it may be to enumerate with a
stupid dictionary attack. A serious attempt at enumeration wouldn't
just do a simple dictionary attack: it would try "generic hyphen
generic", "generic plus string of digits" and so on. This is no
different from how most password crackers work. The dumb ones just use
a dictionary.  The clever ones also try manipulations on the names in
the dictionary: obvious suffixes and prefixes, reversed names, etc,
etc.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Jim Reid <[email-masked]>
Date: Thu, 29 Jul 2004 20:57:50 +0100

>>>>> "Jay" == Jay Daley <[email-masked]> writes:

    Jay> That is precisely my point.  As the register grows the
    Jay> namespace becomes more complex, which then leads to searching
    Jay> ever increasing numbers of possiblities for ever decreasing
    Jay> results.  This appears at first sight to be a limiting
    Jay> function and what we are all arguing about it where that
    Jay> limit is.

I'm not sure that either is the case. Dictionary attacks will mean
zone enumeration is always successful, if not always complete. There
are other ways of enumerating a zone that have been mentioned in this
list a while ago. Zone enumeration is already going on. And presumably
the results of that are "good enough" for whoever is doing the
enumeration, whether they're getting 1% or 100% of the zone.

It would be good to know how effective a concerted dictionary attack
would be on some TLD. But I don't see this making much of a difference
to the wider debate. Those who oppose NSEC because of the zone
enumeration issues are unlikely to change their minds if a decent
dictionary attack -- just one means of enumerating a zone remember --
yields 80% or 90% or 100% of the zone.