Re: 2 forwarded messages...DNSEXT discussion of Day and Kaminsky
David Nicol <[email protected]>
| Newsgroups | gmane.network.djbdns |
|---|---|
| Message-ID | <[email protected]> |
... off list q and a ... On Mon, Feb 16, 2009 at 5:50 PM, Paul Jarc <[email protected]> wrote: > David Nicol <[email protected]> wrote: >> Because any one of the good ones, which all have valid credentials >> already due to being valid, can return and get cached. > > That doesn't matter. If one forged response gets in, it can carry any > in-bailiwick records the attacker wants; they don't all have to be > about the name the query asked for. The forged responses can poison a > name that the genuine esponses won't say anything about, so it doesn't > matter if the attacker loses other races, as long as they win one. > > > paul so, if any of these birthday attacks are possible at all, would it make more sense, instead playing with the statistics with query merging, to restrict the in-bailiwick stuff even further, to only pay attention to the part of a reply that is directly the response to the question that was asked? Like, further reducing the cache's attention span for greater security?