Subject: Re: DNS Server DoS Attacks

From: "D. J. Bernstein" <[email-masked]>
Date: 23 Nov 2002 17:28:16 -0000

[ post by non-subscriber.  with the massive amount of spam, it is easy to
  miss and therefore delete mis-posts.  your subscription address is
  [email-masked], please post from it or
  fix subscription your subscription address! ]

PGP 2048-bit ElGamal signatures are probably the best choice for
root-zone distribution today: the signature format is reasonably simple
and reasonably well documented, and free signature-checking software is
already widely deployed. Of course, the root-zone protocol can support
multiple signatures on the same file.

Jim Reid writes:
> I can't believe you just said that. Does this mean you have recanted
> on your previous strident objections to DNSSEC? :-)

Have you stopped beating your wife, Jim?

Anyone who wants to see what I've actually said about DNSSEC should read
http://cr.yp.to/djbdns/forgery.html.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "D. J. Bernstein" <[email-masked]>
Date: 23 Nov 2002 19:53:20 -0000

After receiving an email response from the Netherlands, I realize that I
should explain for international readers (and perhaps for some American
illiterates) what ``Have you stopped beating your wife?'' means.

That phrase is, at least in English, a standard reference to a fallacy
pointed out by Aristotle and also known as

   * plurium interrogationum (``many questions'');
   * the fallacy of interrogation;
   * the fallacy of presupposition;
   * the loaded-question fallacy; and
   * the complex-question fallacy.

The fallacy occurs when a question posits an unproven assumption. For
example, the fallacious question ``Have you stopped beating your wife,
Jim?'' presumes that Jim has a wife, and has been beating her; there is
no evidence for these presumptions, and in fact we all presume the
opposite.

Jim asked a fallacious question making certain incorrect presumptions
about what I have said about DNSSEC. I responded by pointing out the
fallacy and the underlying facts.

---

From: Rob Payne <[email-masked]>
Date: Sat, 23 Nov 2002 16:42:01 -0500

> multiple signatures on the same file.

Let me see if I understand your proposal.  You want to turn the root
zone into a signed "hosts.txt" (RFC 952, 953), and how, exactly does
that scale this time around when it did not scale the last time?  More
distribution methods make for more attack vectors and more
opportunities for DOS against different groups.  Maybe it's time to
review section 2.1 of RFC 1034 to see the problems with that model.

Your previous message said:

> The root-zone protocol should promise that every piece of data will
> last for a month.

That data should be guaranteed to last a month from when, exactly?
From the time it was signed, or from when it downloaded?  The former
will mean that *everyone* will be attempting to grab this at the same
time (every thirty days from whenever this process starts), the latter
will mean that the data can *never* change.  The current situation is
that data is valid for a shorter period of time (1 TTL) and systems
can grab it at any time, meaning that an attack has to last for the
current (1/2 TTL) to create an outage that will effect most systems.

If we go to a set of static data, valid for a fixed time frame we
narrow the "window of opportunity" for attack/DOS to a much smaller
period (the first [time period] at the beginning of a 30 day cycle
when everyone is grabbing the root zone, thus putting heavy loading on
servers that are distributing the new information.)  How, exactly does
this provide for a system that is more resistant to attack?  It
actually makes a well planned attack (around the first [time period]
of the update cycle) more likely to create an effective DOS.

And, of course, this still ignores most of the reasons for DNSSEC.
Being able to get trustworthy data from entities with unknown motives
is not possible when the data comes to you without its covering
signatures.  The provider of my DNS service being able to check
signatures which they do not pass along with the data does not do
anything to provide me with usable data.

Nym-based names and bookmarks do not fix the problem.  Each time a key
is compromised, the name changes (the key changes and therefore the
fingerprint of the key which makes up the nym changes).  If there is
no method for a chain of trust check on DNS signature keys, owners of
hosts end up making a choice between invalidating all of the
"bookmarks" that other people have stored for their host, or
continuing to use the compromised key.

				 -rob

---

From: "D. J. Bernstein" <[email-masked]>
Date: 24 Nov 2002 09:27:12 -0000

Rob Payne writes:
> You want to turn the root zone into a signed "hosts.txt" (RFC 952,
> 953), and how, exactly does that scale

I already answered that: ``Effects on load: Everybody will receive the
entire zone, rather than just the parts they need. On the other hand,
any sensible format would be much smaller than DNS packet format. More
importantly, the data will be cached much more effectively than it is
with the current root-zone protocol. Most importantly, the load will be
very widely distributed.''

The last factor is, as I said, the most important one. USENET wouldn't
notice if ten copies of the root zone---or ten thousand copies---were
sent out every day.

> it did not scale the last time

Nobody really tried to make it scale, but this is beside the point.
``Root zone'' does not mean ``complete list of Internet hosts.''