Subject: Re: dictionary attack on nameservers

From: Bruce Campbell <[email-masked]>
Date: Thu, 19 Aug 2004 09:30:17 +0200 (CEST)

> > Sensitivity to attack rate and false-positive rate can be adjusted by
> > tweaking the window size, the color count and the decay timer..
> >
> > Popular names can be locked green permanently -- the walk-detector
> > will fire quickly enough once you get into dustier parts of the zone.
>
> i love this plan.  it's simple and elegant.

Also preseed the domain with certain
effectively-only-reachable-via-NSEC-walk names, and you're done.

> got anything that will help the non-dnssec case, where queries need neither
> be sequential nor sole-sourced in order to effectively enumerate zones with
> well understood allocation schemes?

No.

By their very nature, domains with a 'tight' naming scheme (any of the
so-called 'reverse' zones, including enum) are extremely susceptible to
enumeration.

You can solve this for a small number of clients walking through by doing
real-time analysis of query patterns (assuming you control all the
authoritative servers), but you cannot solve it in cases where the
attacker has patience and/or an extreme number of sources.

Proposed solutions to enumeration problems should be limited to domains
with 'loose' naming schemes (ie, the forward zones).

--==--
Bruce.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Edward Lewis <[email-masked]>
Date: Thu, 19 Aug 2004 08:25:00 -0400

>with 'loose' naming schemes (ie, the forward zones).

This is not consistent with the history of the development of the DNS 
protocol.  The protocol should be independent of the data it carries. 
Basic infrastructure must remain neutral to its use.

The consequences are - complexity of the protocol (having to branch 
in the control plane based on the contents of the data plane) and 
built-in limitations of how the protocol can be extended into the 
future.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

"I can't go to Miami.  I'm expecting calls from telemarketers." -
Grandpa Simpson.