Subject: Re: DNS over SCTP

From: AJ Jaghori <[email-masked]>
Date: Tue, 11 Aug 2009 23:47:09 -0400

This is a common misconception.  DNS over SCTP will not solve 90% of the
problems!

On Thu, May 28, 2009 at 10:16 AM, Alessandro Vesely <[email-masked]> wrote:

> Stephane Bortzmeyer wrote:
>
>> It seems that DNS over SCTP would solve 90% of the problems with 10%
>>> of the efforts and resources required to implement DNSSEC. However,
>>> I hear more often about the latter than the former. How come?
>>>
>>
>> I've read this message via the IETF general mailing list and so I
>> missed the beginning. In what way can you compare DNSSEC (which
>> provides object security) and SCTP or TCP (which provide a better
>> channel security for DNS)?
>>
>
> The discussion was about how to get rid of the threats illustrated, e.g.,
> in Kaminsky, D.: "It’s the end of the cache as we know it." In: Black Hat
> conference (2008). Online at http://www.doxpara.com/DMK_BO2K8.ppt
>
> _______________________________________________
> Ietf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf
>

---

From: Alessandro Vesely <[email-masked]>
Date: Wed, 12 Aug 2009 09:29:06 +0200

> This is a common misconception.  DNS over SCTP will not solve 90% of the 

Why?

Attackers are able to guess what DNS queries an SMTP server would put 
as a consequence of a client connection. Even after the Kaminsky fix, 
that leaves room for brute force attacks. If queries were run over 
TCP, the additional requirement to hijack a TCP connection would 
reduce the probabilities enough, even for today's botnets. Thus, using 
TCP would solve those security issues. (Is that 90%?) It would 
introduce some inefficiency, though. (More than DNSSEC?)

SCTP provides for several streams over a single connection, streams 
are asynchronous with one another like UDP packets, but are reliably 
connected and secured like TCP streams. With decent keep-alive 
directives, that would allow a client to be connected with a pool of 
relevant resolvers, thereby avoiding the inefficiencies that TCP would 
introduce.

> On Thu, May 28, 2009 at 10:16 AM, Alessandro Vesely <[email-masked] 
> <mailto:[email-masked]>> wrote:
> 
> The discussion was about how to get rid of the threats illustrated,
> e.g., in Kaminsky, D.: "It’s the end of the cache as we know it."
> In: Black Hat conference (2008). Online at http://www.doxpara.com/DMK_BO2K8.ppt