Subject: Re: dictionary attack on nameservers

From: Alex Bligh <[email-masked]>
Date: Sat, 07 Aug 2004 10:56:58 +0100

--On 06 August 2004 23:10 +0100 Jim Reid <[email-masked]> wrote:

> Rubbish! As soon as that node is in the public DNS tree, it is public.
> The very fact that you created the node in a public tree indicates
> your acceptance that the name is public. You've published it.

Seems to me there is a qualitative difference between publishing the node
(with RRs), which is expected behaviour, and publishing an index of all
nodes (which has not historically been expected behaviour for those
disabling AXFR).

I don't claim to be qualified to pontificate as to whether that affects
enterprise security, but the two seem to me to be different things, and
hence I can see why they might have different results.

Alex

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: George Michaelson <[email-masked]>
Date: Mon, 9 Aug 2004 12:54:06 +1000

I found the presentation on the dictionary attack very useful to stimulate thinking
about the implications.

If the 'pre DNSSEC' baseline is as high as 10-20% available by simple attack, then
it does bring into question the benefit of limiting the walk. Thats a significant
weakness in the current deployed base. You can take the other side, and say there
is potential for a benefit in deploying DNSSEC of course, but the view right now
is 'at least do no more harm' and I would say, when 20%+ is visible at a low cost
then the protection cost may be higher than the benefit. (I am assuming that
more clever attacks will emerge, so the high end counts get higher)

In reverse of course, we have such a deterministic namespace that there is no
meaningful protection against 'reverse IP dictionary attack' except perhaps in
V6. -And I suspect this also provides significant entrypoints into the forward
namespaces, since names in reverse can act as dictionary-attack pump-priming
values to feed into the forward space.

cheers
	-George