Re: 2 forwarded messages...DNSEXT discussion of Day and Kaminsky

Dean Anderson <[email protected]> wrote:
> This appears to increase the vulnerability, particularly if the UDP
> ports can be predicted because they don't change as often. In that case,
> the attack is reduced to number of probable UDP ports * 64k packets to
> run though the QIDs.

I'm not following you - what makes you think UDP ports won't change as
often?

> An important point was that Kevin's formula for Birthday attack was
> wrong, as was their whole mathematical analysis.

Are you talking about the analysis in
http://www.your.org/dnscache/djbdns.pdf, or something else?  Can you
explain exactly where it goes wrong?


paul