Re: update on the djbdns bugs? (fwd)

Yep, that "*" instead of "/" was a mistake I caught at the time, just 
after I sent the email to Kaminsky and Day.

But the "roulette logic" that Kaminsky asserts is complete BS, which if
you read the whole thread, is what counts.  I got the math right.  
Kaminsky and Day just made up "roulette logic".  It comes within an
order of magnitude of the right number in this case, but is wildly wrong
in other cases (different number of items selected, different urn size)

		--Dean

On Wed, 10 Mar 2010, Matthew Dempsky wrote:

> On Wed, Mar 10, 2010 at 3:40 PM, Dean Anderson <[email protected]> wrote:
> >> Dean, I was using simple roulette logic.  65,536 ports * 65,536 qids /
> >> 200 simultaneously valid responses = 21M.  We're dealing in orders of
> >> magnitudes, it's a reasonable approximation.
> >
> > You still seem to be channeling Palin:
> >
> > (%i69) 65536 * 65536 * 200;
> > (%o69)                           858993459200
> >
> > Quite a bit higher than 21M.
> 
> For anyone thinking Dean deserves any credibility on this issue, take
> a look at just this simple example: Dan Kaminsky is pointing out that
> 65536 * 65536 / 200 = 21M, but Dean counters by pointing out that
> 65536 * 65536 _*_ 200 != 21M.
> 
> > But you have no credible explanation for your math.
> 
> Further, the math behind Dan's number is straight forward: an attacker
> has to guess two 16-bit numbers (i.e., the 65536 * 65536), but there
> are 200 winning pairs to choose from (i.e., the 200 outstanding
> queries for identical names).  Having more winning pairs means the
> number of expected guesses before success *decreases* (i.e.,
> division), not increases (i.e., multiplication).
> 
> 

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 256 5494