Re: 2 forwarded messages...DNSEXT discussion of Day and Kaminsky

On Sat, Feb 28, 2009 at 11:59:51PM -0500, Dean Anderson wrote:

> > No, you're wrong.  An attacker only has to successfully forge one
> > response, not 200.
> 
> An attacker must send the right QID to the right port. They do not know
> which of the 200 ports have which QID, NOR do they know which of the 200
> ports are using THEIR Query tuple. So they have to send all QIDs to all
> 200 ports.  So your assumption that they could pick one is wrong.

No, they need only poison one. They pick a port, and then try to guess
the QID for that port. They succeed if and only if the port matches
their query tuple, and they guess the QID correctly.

I described the resulting probabilities already in much more detail
here:

  http://article.gmane.org/gmane.network.djbdns/13817

-Peff