Subject: Comments on dns-cookies draft vs. amplification attacks

From: Michael Graff <[email-masked]>
Date: Tue, 11 Mar 2008 09:36:42 -0500

My comments are with section 2.1 of the rev 3 draft.

I like the cookies in the resolver-created queries, and their echo in the auth 
server-created responses.  This allows a resolver to add as many entropy bits 
to the query id as desired to protect from out-of-band attacks.  However, I 
disagree that having the auth server check and maintain state about known 
resolvers is of practical use.

The reason it is there from discussion with Donald Eastlake was that it would 
prevent DDoS attacks where auth servers are used as amplification attacks.  I 
do not believe the added complexity warrants this, as it is not, IMHO, 
effective.

It will protect resolvers from DDoS attacks of the amplification variety, but 
it will not protect (say) www.google.com, which is unlikely to send queries 
to auth servers, and therefore will never have negotiated a cookie with an 
auth server.  Thus, unless auth servers refuse to answer clients without a 
valid cookie, meaning people have fully and universally implemented 
dns-cookies, only recursive resolvers are actually protected from flood 
attacks.

If dns-cookies were to move forward, I'd rather see it as a "edns0 echo" and 
make it purely client-driven, and have the server simply reply with whatever 
the client included.  The complexity of how this value is generated on the 
client, how the server maintains this state, etc. should all be removed, and 
only a maximum length be recommended.

--Michael

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Eastlake III Donald-LDE008" <[email-masked]>
Date: Mon, 17 Mar 2008 17:10:33 -0400

I had originally planned to push for making this a working group draft
but have been convinced by Michaels arguments at the DNSEXT meeting and
below. Cookies as described in my -03 draft only make sense if you think
that draft is a step towards mandatory deployment, which seems
implausible.

If there is interest, I'd be happy to do a radically simplified -04
which was just an "edns0 echo".

Donald

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Michael Graff
Sent: Tuesday, March 11, 2008 10:37 AM
To: [email-masked]
Subject: Comments on dns-cookies draft vs. amplification attacks

I like the cookies in the resolver-created queries, and their echo in
the auth 
server-created responses.  This allows a resolver to add as many entropy
bits 
to the query id as desired to protect from out-of-band attacks.
However, I 
disagree that having the auth server check and maintain state about
known 
resolvers is of practical use.

The reason it is there from discussion with Donald Eastlake was that it
would 
prevent DDoS attacks where auth servers are used as amplification
attacks.  I 
do not believe the added complexity warrants this, as it is not, IMHO, 
effective.

It will protect resolvers from DDoS attacks of the amplification
variety, but 
it will not protect (say) www.google.com, which is unlikely to send
queries 
to auth servers, and therefore will never have negotiated a cookie with
an 
auth server.  Thus, unless auth servers refuse to answer clients without
a 
valid cookie, meaning people have fully and universally implemented 
dns-cookies, only recursive resolvers are actually protected from flood 
attacks.

If dns-cookies were to move forward, I'd rather see it as a "edns0 echo"
and 
make it purely client-driven, and have the server simply reply with
whatever 
the client included.  The complexity of how this value is generated on
the 
client, how the server maintains this state, etc. should all be removed,
and 
only a maximum length be recommended.

--Michael