Re: 2 forwarded messages...DNSEXT discussion of Day and Kaminsky

On Fri, Feb 13, 2009 at 2:54 AM, Dean Anderson <[email protected]> wrote:

>  With exactly one port, that port might be
> predictable, or they might be able to find it easilly with a quick scan
> for open/closed ports. And we know exactly how hard that is (65k
> packets)

scan for open ports?  Should a dnscache firewall out the ICMP stuff
that makes such scans possible?

Anyway, your comments about predictability of ports had me opening up
the djbdns source, and I find within socket_bind.c the local port
randomization; the dns_random routine is used (or at least, attempted
ten times) rather than relying on the OS's random port assignment, as
advertised.  dns_random.c does take inertia from time and pid and
ppid, at init time.  It is not immediately clear to me how long the
sequence produced would before it starts repeating, of if there is
predicatability based on knowing a series of recent ports, a range of
ports to see soon.  Disk space is now cheap enough that it would be a
practical little research project to empiracally run some chaos
analysis on dns_random(64510) and see if there is any predictablity or
not.

I also did not check to see if there is periodic reinitialization or
other occasional entropy injection.  Adding a periodic entropy
injection would not be that difficult, but it may be meaningless.