Subject: Re: (in)Security Analysis and Catastrophically bad Design: Re: [dnsext] DNSCurve Internet-Draft (fwd)

From: Nicholas Weaver <[email-masked]>
Date: Thu, 4 Mar 2010 13:39:42 -0800

On Mar 4, 2010, at 12:43 PM, Dean Anderson wrote:
> 
> Those are not the DNSSEC record set sizes.  They are irrelevant to the
> DNSSEC DOS attack.  
> 
> Remember also that DNSSEC requires (practical purposes) a 2Kbit key 
> size, which dramatically increases the DNSSEC RR Set that is returned on 
> every query.
> 
>> DNSSEC signatures on such data do not increase the amplification
>> factor by an "order of magnitude" which some have claimed.  
> 
> True but misleading. Its not a factor of 10;  Its a factor of 100+:  An
> 2kb-8kb response for 64byte query.

The total amplification doesn't matter, its the DELTA amplification that counts.   

The best you can do is the ANY query, which is big but still only 3.5x larger than a non-DNSSEC TLD's "ANY" response.

And given the specialness of such queries, your "can't filter" claim on the authority is incorrect BTW, as these ARE not normal autonomous queries.

You can test such queries against ns1.nic.uk, as they are signing the data (albeit not having their key into a trust repository, as they are just waiting for the root to sign).

>> The amplification from the authorities is shockingly mild when you
>> actually measure it, because of the ability to generate large
>> responses from the roots and TLDs for queries like NS.
>> 
>> A concrete example:
>> 
>> dig +norecurse NS uk @ns1.nic.uk: 482 bytes
>> dig +norecurse +dnssec NS uk @ns1.nic.uk: 655 bytes.
> 
> Please don't be disingenous by quoting non-DNSSEC sizes in relation to 
> dispute size of DNSSEC DDOS attack.

How is it disingenuous?  Without DNSSEC, the attacker can still cause the authority to generate very large replies.  Which is what matters: not whats in the replies from the roots or the TLDs, but how big the replies are.  The "amplification" which counts is the amplication vs non-DO queries, not the total "amplification" from the incoming packet.

If you exclude ANY queries, the best I can get out of .uk is 750B for DNSSEC-based responses, compared with ~500B for non-DNSSEC responses, which is hardly any amplification at all.