Re: 2 forwarded messages...DNSEXT discussion of Day and Kaminsky

Dean Anderson <[email protected]> wrote:
> On Thu, 12 Feb 2009, Paul Jarc wrote:
>> I'm not following you - what makes you think UDP ports won't change as
>> often?
>
> Before:
> 200 uncached queries, 200 udp ports consumed and 'returned to the Urn'.
>
> After patch:
> 200 uncached queries, perhaps 1 udp port consumed.

200 incoming queries, but only 1 outgoing query.  The rate of
consuption of UDP ports is still 1 port per outgoing query, with or
without the patch.  If changing the ratio of incoming queries to
outgoing queries is relevant, I don't see how.

> With caching, Attacker makes one query that will hit its nameserver,
> records the port, predicts the likely next port,

dnscache selects the source ports for its outgoing queries using a
PRNG.  If the atacker can predict the likely next port based on a
previous port, that's a weakness in dnscache's PRNG.  Do you have
evidence of such a weakness?

>> > An important point was that Kevin's formula for Birthday attack was
>> > wrong, as was their whole mathematical analysis.
>> 
>> Are you talking about the analysis in
>> http://www.your.org/dnscache/djbdns.pdf, or something else?  Can you
>> explain exactly where it goes wrong?
>
> Kaminsky's formula and the correct formula are in two messages I sent
> from DNSEXT.

I didn't ask about errors in Dan Kaminsky's math.  I asked about Kevin
Day's.


paul