Re: 2 forwarded messages...DNSEXT discussion of Day and Kaminsky

On Sun, 22 Feb 2009, Jeff King wrote:

> Here's the short version for those that are impatient:

Your short version is different from my short version.

>   The number of possible ports from which an attacker must choose is
>   lower with qmerge, which intuitively means their chance of success is
>   better. But the number of ports which grant success is _also_ lower,
>   which reduces their chances.

Err, I think not. 

The effect (one of several) is to lower number of ports in use. This
appears at first glance to make the birthday attack harder, but makes it
easier to constrain and identify the correct port.  If the attacker
knows or can discover the one port in time to beat the (sole) response
packet, or DOS the sole query/response pair to gain enough time to
discover the port, they win.



> Let X be the number of active queries that want to know Q.
> 
> Let N be the number of active queries that care about something other
> than Q.
> 
> Let O be the number of other UDP ports open on the system, not due to
> dnscache.
> 
> We want to know the probability P that the spoof succeeds.
> 
> With stock dnscache, each of the X+N active queries opens a new port. So
> the chances of hitting a port which belongs to dnscache and matches our
> Q is X/(X+N+O). The chances of hitting the queryid correctly for that
> port are 2^-16. So
> 
>   P = X / (X+N+O) * 2^-16

How did you arrive at that formula?

(%i55) n: 0; x: 200; o: 100;
(%o55) 0
(%o56) 200
(%o57) 100
(%i58) p: x / (x + n + o) * 2^16;
(%o58) 131072/3
(%i59) float(p);
(%o59) 43690.66666666666

Hmm. I thought probabilities ranged from 0 to 1.

After I get my distribution of DNScache done, I'll post what I think to
be the correct math on the site.
		--Dean


-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000