Re: 2 forwarded messages...DNSEXT discussion of Day and Kaminsky

On Wed, 18 Feb 2009, Matthew Dempsky wrote:

> On Tue, Feb 17, 2009 at 10:45 PM, Dean Anderson <[email protected]> wrote:
> > My solution keeps the randomness high (keeps the popcorn popper going
> > full steam),
> 
> If I need 5 fair die rolls, I'm going to get equally random results if
> I roll a fair die 5 times or if I roll it 50 times and only take every
> 10th roll.

Ports aren't dice. And as explained, UDP port selection isn't perfectly
random.

> > For example, if you change it so to bind the port to 53, the chances of
> > a brute force attack change to 1 in 65536. Doh.
> 
> Did you honestly think such a change is on topic?  We might as well
> discuss changes that remove the chroot/setuid protections and call
> system(3) on every incoming packet.

??? It is on topic because it demonstrates the flaw in your argument
that changes are irrelevant to the success of an attack.  Its a counter
example proving your assertion wrong.

		--Dean


-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000