Re: 2 forwarded messages...DNSEXT discussion of Day and Kaminsky

On Fri, 13 Feb 2009, Paul Jarc wrote:

> Dean Anderson <[email protected]> wrote:
> > On Thu, 12 Feb 2009, Paul Jarc wrote:
> >> I'm not following you - what makes you think UDP ports won't change as
> >> often?
> >
> > Before:
> > 200 uncached queries, 200 udp ports consumed and 'returned to the Urn'.
> >
> > After patch:
> > 200 uncached queries, perhaps 1 udp port consumed.
> 
> 200 incoming queries, but only 1 outgoing query.  The rate of
> consuption of UDP ports is still 1 port per outgoing query, with or
> without the patch.  If changing the ratio of incoming queries to
> outgoing queries is relevant, I don't see how.

??? 

The rate of consumption of ports is substantially less.  The 'popcorn
popper pops slower'.  Usually this is a bad thing.


> > With caching, Attacker makes one query that will hit its nameserver,
> > records the port, predicts the likely next port,
> 
> dnscache selects the source ports for its outgoing queries using a
> PRNG.  If the atacker can predict the likely next port based on a
> previous port, that's a weakness in dnscache's PRNG.  Do you have
> evidence of such a weakness?

Not exactly. It uses a PRNG 10 times to pick a port that isn't already 
in use. If that fails, it uses whatever port the OS gives it.  As I 
said, it should be pretty random, but isn't guaranteed to be random. 

> >> > An important point was that Kevin's formula for Birthday attack
> >> > was wrong, as was their whole mathematical analysis.
> >> 
> >> Are you talking about the analysis in
> >> http://www.your.org/dnscache/djbdns.pdf, or something else?  Can
> >> you explain exactly where it goes wrong?
> >
> > Kaminsky's formula and the correct formula are in two messages I sent
> > from DNSEXT.
> 
> I didn't ask about errors in Dan Kaminsky's math.  I asked about Kevin
> Day's.

I didn't read that PDF---I read Day's and Kaminsky's email text to me.  
I don't usually open PDF's from blackhats if I don't have to, since the
format can contain javascript exploits which can elude my virus scanner.
But I was in communication with both Day and Kaminsky, who say they are
working together, and I have no reason to think their analyses differ. I
don't know if the PDF contains the correct or incorrect math.  I only
know that I corrected their math in response to their emails with the
wrong math.

Why do you think it matters?


		--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000