Subject: RFC proposal on DNS spoofing prevention

From: bert hubert <[email-masked]>
Date: Thu, 10 Aug 2006 22:00:25 +0200

Dear namedroppers,

Remco van Mook and I have written an RFC draft that explains the risks of
DNS spoofing, and how to address these by a proper combination of zone
configuration and nameserver software.

It can be found on:

 * http://ds9a.nl/rfc/dns-anti-spoofing.html
 * http://ds9a.nl/rfc/dns-anti-spoofing.txt
 * http://ds9a.nl/rfc/dns-anti-spoofing.xml

Some salient quotes:

	For example, using the formula derived earlier on a domain with a
	3600 second TTL, an attacker sending 7000 fake answer packets/s (a
	rate of 4.5Mb/s), stands a 10% chance of spoofing a record in the
	first 24 hours, which rises to 50% after a week.

	For a domain with a TTL of 60 seconds, the 10% level is hit after 24
	minutes, 50% after less than 3 hours, 90% after around 9 hours.

	(...) 
	
	These and other developments have made the security and
	trustworthiness of DNS of renewed importance. Although the DNS
	community is working hard on finalising and implementing a
	cryptographically enhanced DNS protocol, steps should be taken to
	make sure that the existing use of DNS is as secure as possible
	within the bounds of the relevant standards.

	It should be noted that the most commonly used resolver currently
	does not perform as well as possible in this respect, making this
	document of urgent importance.

I've not previously written an RFC (although Remco co-authored RFC 2322,
which is in itself a spoof), so this process is very new to us.

We understand there are two options, an individual submission to the RFC
editor, or via the DNSEXT-WG. Each has its advantages. Olaf has already
given me some guidance, I'd appreciate hearing (perhaps privately) from
DNSEXT-WG members on the best way to proceed.

We are aware this RFC might be viewed as PowerDNS promotional material, it
is hard to defend ourselves against that allegation. This draft is written
because of a profound worry over the practical security of common current
DNS resolver implementations.

We do point out that there are (at least) two freely available nameserver
implementations that adhere to the recommendations set out in this draft,
and that the relevant PowerDNS products are 'free as in speech' as well. 

We hope list members will review this RFC draft from a technical
perspective, and that we can as is customary discuss without descending into
comparing specific implementations.

Kind regards,

bert hubert 
Remco van Mook

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://netherlabs.nl              Open and Closed source services

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>