Re: 2 forwarded messages...DNSEXT discussion of Day and Kaminsky

On Wed, 18 Feb 2009, Paul Jarc wrote:

> I don't think this attack works any better against a qmerge-patched
> dnscache.  Although dnscache forgets about its previous outgoing
> queries, the kernel doesn't know that it has forgotten.  There's no
> external evidence that would show up in the attacker's probe.

Your analysis is incorrect:

1. The state of the kernel is indeed affected by the rate of ports being
consumed and returned. (previously explained)

2. The randomness of the ports is affected by using fewer ports.  The
fewer ports (a single port) might be easier to discover and identify.
(previously explained)

3. The number of queries sent to an authority server are affected by the
qmerge changes. (previously explained)

4. The number of responses returned by authorities servers are affected
by the qmerge changes. (previously explained)

These are all consequences of a change proposed by a BLACKHAT to solve a
virtually NON-existant problem. A non-problem that can be solved WITHOUT
these consequences by merely falling back to TCP, as I already
explained.  What do you think the smart thing to do is? I know what I'm
going to do.

As to motives, as I said before, it might be the case the BIND cartel
just wanted to smear DNScache with a "security bug" of its own, or it
might be the case that the BIND cartel staged this whole thing to change
BIND and get everyone to take the patches, giving all the credit for the
'discovery' to Kaminsky without having to concede that Bernstein
discovered this problem and discovered the fix years ago. Perhaps it
doesn't matter. What matters is that Kaminsky didn't discover anything
about DNS on which to hang his name.

Reputation also matters. People with good reputation know this, and
people with bad reputation complain about it. Too bad for them.

Anyway, I'm done. There hasn't been anything new in a couple days.

I'll announce my DJB DNS distribution in a week or so.


		--Dean


-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000