Subject: Re: DNS Blackhole attack

From: Dean Anderson <[email-masked]>
Date: Sun, 6 Mar 2005 00:03:20 -0500 (EST)

On Sat, 5 Mar 2005, Hallam-Baker, Phillip wrote:
> This just appeared on the SANS list. Time to stop arguing and get DNSSEC
> deployed.

I've not been testing DNSSEC, but I understand it requires TCP. So, DNSSEC
cannot be deployed on root servers, due to large number of root servers
using anycast, and anycast conflict with the DNSSEC's TCP requirements.
(Anycast only works on UDP single packet per transaction protocols. ISC
mistakenly told root operators that anycast can be deployed with TCP.) So,
DNSSEC probably won't be very effective at preventing cache poisoning
attacks.

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000   

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Masataka Ohta <[email-masked]>
Date: Sun, 06 Mar 2005 14:22:41 +0900

> using anycast, and anycast conflict with the DNSSEC's TCP requirements.

That is not a valid reason to avoid DNSSEC. Anycast does work with
short-lived TCP.

However, the security problem, here, is not inherent to DNS but
is caused by poor implementation of it, which is why we MUST
avoid DNSSEC which is a lot more complex than DNS and is
assured to make its implementations poor and insecure.

						Masataka Ohta

---

From: Frederico A C Neves <[email-masked]>
Date: Sun, 6 Mar 2005 02:21:55 -0300

On Sun, Mar 06, 2005 at 12:03:20AM -0500, Dean Anderson wrote:
> I've not been testing DNSSEC, but I understand it requires TCP.

No it doesn't. 

Please read 2671 and the 3 drafts
draft-ietf-dnsext-dnssec-[intro|protocol|records] on RFC Ed Queue.

... (removed conclusions based on wrong assumption).

---

From: David Conrad <[email-masked]>
Date: Sat, 5 Mar 2005 21:28:31 -0800

Hi,

You don't need TCP for DNSSEC (see EDNS0).

There is already discussion about deploying DNSSEC on the roots (in 
fact, there has been for quite a while -- the root ops are very 
conservative in deploying new stuff (as they should be)).

TCP can be used for anycast, but that's not relevant for this WG.  I'll 
let folks from ISC speak for themselves about what they may or may not 
have told the root operators.

Rgds,
-drc

---

From: Florian Weimer <[email-masked]>
Date: Sun, 06 Mar 2005 12:01:59 +0100

> This just appeared on the SANS list. Time to stop arguing and get DNSSEC

There are at least four types of cache poisoning attacks:

  (1) Attacks which blindly spoof name server replies.  Because of the
      16 bit message ID, these attacks are always practical
      (especially if a constant query source port is used), even if
      implementations use hard-to-guess IDs.

  (2) Attacks which exploit weaknesses in resolver implementations
      which fail to discard bogus data received from authoritative
      name servers they have queried.

  (3) Attacks which exploit DNS configuration management systems which
      do not correctly filter some records.

  (4) Some ISPs have broken DNS management procedures which set up
      delegations for customers even though they do not receive a
      delegation from a parent zone for it.

>From what I've heard, the current round of attacks is indeed in
category (2).  DNSSEC does not prevent this (and it doesn't help
against (3) and (4), either).  One could even argue that DNSSEC's
complexity will result in further vulnerabilities in the
interpretation of the meaning of DNS responses.

---

From: [email-masked]
Date: Sun, 6 Mar 2005 14:32:20 +0000

> I've not been testing DNSSEC, but I understand it requires TCP. So, DNSSEC

	you might want to try it out to be sure of your understandings.

> mistakenly told root operators that anycast can be deployed with TCP.) So,

	they did?  guess not everyone received the msg.

> DNSSEC probably won't be very effective at preventing cache poisoning

	prevent... perhaps not.  but it could, if used properly.

---

From: Masataka Ohta <[email-masked]>
Date: Mon, 07 Mar 2005 01:05:15 +0900

>       name servers they have queried.

Actually, attacks can exploit weaknesses in resolver implementations
which fail to distinguish and to separately cache unauthoritative
(delegation) data received from authoritative name servers they
have queried.

DNSSEC can't be helpful, unless parent zones sign glues, which
causes serious management troubles.

						Masataka Ohta