Re: 2 forwarded messages...DNSEXT discussion of Day and Kaminsky

Dean Anderson <[email protected]> wrote:
> Oh, and one thing I forgot to say, is that as is, there would be 200
> correct responses coming, while with the qmerge patch, there is only
> one. An ordinary DOS attack to cause packets to be dropped (hoping to
> get the authentic packet dropped enroute), is more likely to succeed
> against one packet than against 200.  

This doesn't support an argument for or against the qmerge patch.  An
attack that involves only one of dnscache's outgoing queries, without
regard for what's going on with the other 199 slots, works the same
way with or without the patch.

An attack that takes advantage of duplicate types/names among the
outgoing queries (i.e., a birthday attack) will only work on an
unpatched dnscache, since the qmerge patch eliminates the redundancy
that the attack depends on.

An attack that depends on non-redundancy among the 200 outgoing
queries might work better on a qmerge-patched dnscache.  But I can't
think of any way an attack would depend on that non-redundancy, and
even if there were such an attack, it would typically work about as
well on an unpatched dnscache, since redundancy doesn't typically
arise except as the result of an attack.


paul