Re: Dishonest Forks? | Was - Re: [Namedroppers-honest] Brian Smith asks: Who is Dean Anderson?

I wrote:
> Kevin <[email protected]> wrote:
>> He has 100ms to send 1000 packets though, so his probability of
>> exploitation is 0.000000698491931.
>
> Numerically, that's very close, but you're using the wrong
> calculation.
>
> With 1000 forged answers, the probability of at least one of those
> 1000 being successful against one outgoing query is not
> 1000*(probability of 1 forged answer succeeding).  Using ** for
> exponentiation, it should be:
>   1-(probability of all 1000 failing)
> = 1-(probability of 1 forged answer failing)**1000
> = 1-(1-probability of 1 forged answer succeeding)**1000
> = 1-(1-3*2**-32)**1000
> = 6.98491687260119776e-07
> 1 in ~1,431,656.
>
> Even that probably still isn't right, because it assumes that the 1000
> forgeries are generated independently, with possible duplicates among
> them.  If the attacker ensures that each forgery is distinct, then the
> probability of success is somewhat larger.  The calculation also gets
> quite a bit more complicated at that point, as Dean said.

Hmm... actually, when you're only attacking one outgoing query, and
the 1000 forgeries are all distinct, that makes hits from different
forgeries mutually exclusive.  Then you *can* simply sum the
probabilities, so 1000*(probability of one forgery succeeding) was
right.  But with multiple outgoing queries, matches from different
forgeries are no longer mutually exclusive (nor independent, if the
forgeries are all distinct), so then it gets complicated again.


paul