Re: 2 forwarded messages...DNSEXT discussion of Day and Kaminsky

On Thu, Feb 12, 2009 at 1:27 PM, Dean Anderson <[email protected]> wrote:
> I think your patch weakens DNScache to attacks based UDP port
> prediction.

Sorry, I think you're nuts.

Stock dnscache from djbdns-1.05 can have 200+ outstanding UDP queries.
 To forge a response to one of these queries, an attacker has to guess
the port, qid, type, and name; port and qid are cryptographically
randomly generated 16-bit numbers and type/name are attacker
controlled.  With stock dnscache, potentially all of the 200+ queries
might have the same type/name.  An attacker can then send a forged
response packet with a given type/name and random port/qid and it
succeeds if it matches any 1 of the 200+ outstanding UDP queries,
giving him a 200x improvement in odds to forge a response packet.

However, if dnscache has been patched with the qmerge patch, then
every outstanding packet has a unique type/name, so every forged
packet an attacker sends can match at most one outstanding UDP query.

I'll weigh in that I'm not a big fan of how the qmerge patch is
implemented, and I don't think most dnscache deployments are
vulnerable to this attack (ISPs being the main exception), but as far
as I can tell it does seem to address this issue, and I don't think
your arguments about reducing security hold any water.