Subject: Re: dictionary attack on nameservers

From: Paul Vixie <[email-masked]>
Date: Sun, 22 Aug 2004 16:57:24 +0000

> > It won't be too long before some Registry coddles up a nameserver
> > that detects nsec/other-based enumuration query trends, and starts
> > dynamically inserting bogus records to lead the attacker through a
> > twisted trail of normally-non-existent domains (ala web page scripts
> > that provide lots of bogus email addresses to fill a scrapper's
> > database with crap).
> 
> Dynamic insertion of records would require a signing key to be
> available to all nameservers.

i don't think that's true.  the DNS I-N-D model is that updates are
applied at the master server and then trickle down to the slave servers.

in the BIND9 case, only the master server for a secure zone needs the
signing key, and the zone would be incrementally re-signed after each
UPDATE, and the changes would be NOTIFY'd and IXFR'd out to the slaves.

and as far as i know, BIND9 follows/respects all the relevant standards.

so, if dynamic bogus name insertion were used as a defense against an
"enumeration attack", then only the master server would need an online
signing key.

of course, i don't think this would be a good "defense", or even that
enumeration constitutes an "attack".  but i wanted to set the record
straight about the DNS I-N-D model as it applies to dynamic secure zones.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Sun, 22 Aug 2004 23:42:36 +0000

> > ...
> This would require secondaries to notify the primary of attacks so it
> could start generating the bogus records, then.

no.  you're still not seeing the full model.  the slave server who detected
the attack would start generating dynamic updates toward the master server,
who would apply them, incrementally resign the zone, and do NOTIFY/IXFR to
propagate these changes back out to all of the slave servers for the zone.

> Probably this would be required to detect them, otherwise the attacker
> would distribute over the secondaries. So, OK, I agree - but it would
> be horribly slow.

the fact that you would have to know the query streams at all of a zone's
servers, in real time, in order to detect an enumeration attack, is not the
result of the I-N-D model.  interestingly, this need for universal knowledge
means that almost no ratelimit-based defense is practical, unless the zone
is served by a single (gigantic?) server, which is also impractical.