Subject: Re: (in)Security Analysis and Catastrophically bad Design: Re: [dnsext] DNSCurve Internet-Draft (fwd)

From: Nicholas Weaver <[email-masked]>
Date: Thu, 4 Mar 2010 12:09:14 -0800

On Mar 4, 2010, at 11:14 AM, Dean Anderson wrote:

> On Thu, 4 Mar 2010, Nicholas Weaver wrote:
> 
>> 
>> On Mar 4, 2010, at 9:30 AM, Dean Anderson wrote:
>>> An important difference between DNSCurve and DNSSEC is that DNSSEC also
>>> enables a new and serious DDOS attack (as I described previously), while
>>> I don't think DNSCurve can be so similarly abused.  There are several
>>> more flaws in DNSSEC that aren't shared by DNSCurve. (previously 
>>> described)
>> 
>> Actually, this is a myth: There are enough open recursive resolvers,
>> and enough ability to choose names to query for these, that DNSSEC is
>> NOT needed to produce huge amplification for a spoofed-source
>> reflector attack.
> 
> Technically, one can indeed perform a reflector attack without DNSSEC.  
> But that's like saying the accelerator can stick on a ford, not just a
> toyota.

If you wish to restrict the discussion to reflector attacks off of root and TLD authority servers, rather than from open recursive resolvers (where indeed, I can generate 4000B responses really easily, I can find them trivially, and its mostly stupid NATs really so its not like the open relay problem...), under the grounds that you can't block them because the roots and TLD roots are special, "NS ." is still 460B.  NS com is 520B.  NS uk is 493B.

DNSSEC signatures on such data do not increase the amplification factor by an "order of magnitude" which some have claimed.  The amplification from the authorities is shockingly mild when you actually measure it, because of the ability to generate large responses from the roots and TLDs for queries like NS.

A concrete example:

dig +norecurse NS uk @ns1.nic.uk: 482 bytes
dig +norecurse +dnssec NS uk @ns1.nic.uk: 655 bytes.

So a whopping 35% increase in packet size.  DNSSEC is not some gross amplification, but a fixed overhead when you already have large responses you can cause the roots and TLD roots to generate.

And nobody bothers with either sort (from authority or from resolver/proxy) of reflector attacks these days because

a)  DOS is lame: Anyone you'd want to dos for money/profit is well protected (eg, try DOSing Spamhaus or the FBI...) But DOS attacks burn your bots, which are valuable resources to use for other purposes.

b)  IF you are going to DOS someone in the era of botnets, the best bang/buck is usually direct application-level DOS to burn resources on the victim, especially since >80% of the IPs now are behind routers which implement egress filtering.[1]

The DOS threat of DNSSEC is, IMO, scaremongering.

[1] http://spoofer.csail.mit.edu/summary.php

---

From: Masataka Ohta <[email-masked]>
Date: Fri, 05 Mar 2010 08:43:35 +0900

Nicholas Weaver wrote:

> If you wish to restrict the discussion to reflector attacks off
> of root and TLD authority servers, rather than from open
> recursive resolvers (where indeed, I can generate 4000B responses
> really easily, I can find them trivially, and its mostly stupid
> NATs really so its not like the open relay problem...),

As the 4000B responses (from signed root etc.) can not be transported
to many clients, why do we have to be bothered by DNSSEC only to
amplify DDOS?

						Masataka Ohta