Re: Dishonest Forks? | Was - Re: [Namedroppers-honest] Brian Smith asks: ?Who is Dean Anderson?

On Fri, Mar 12, 2010 at 12:30:03AM -0500, Dean Anderson wrote:

> > OK, I tried to follow your math. But it really doesn't make any sense
> > to me.
> 
> Well, I hope you figure it out before they give you a PH.D. in... what?  
> computer science?

Why are you even mentioning this except to be inflammatory? Not once in
this entire debacle have I ever fallen back on my credentials to make a
point. Instead, I have presented factual evidence and made logical
arguments. I expect you to either agree with or refute them. I have no
interest in your ad hominem insinuations.

If it was a sincere question, I am surprised. Since since you seem so
interested in establishing the non-anonymity of everyone involved, you
could easily have found the web page showing my university affiliation,
major (yes, it is computer science), and a list of my academic
publications (and no, I do not do academic research on DNS).

> > ..that the first parameter (the random space) would be 64510*65536.  
> > The second parameter (number of balls in one urn) can remain 200
> > (MAXUDP). The third parameter (number of balls in the other urn) is
> > actually the number of packets sent by the attacker.
> 
> That is incorrect. The first parameter is the size of the Urn, which is
> 64510 ports, since the first 1025 can't be used.

An attacker does not succeed by guessing your port. He succeeds by
guessing your port and qid pair.

> Possibly, you should consult the reference I cited. CRC handbook of
> Applied Cryptography.

I did.  It gives the formula. I never said the formula was wrong. I said
you misapplied it.  Strangely, section 2.15 of the CRC handbook does not
mention DNS spoofing at all, so the application of their balls and urn
formula to the problem at hand is left up to us.

> > you calculate the probability based on a particular number of packets.
> 
> ???? If you know one, you can calculate the other.

A probability does not have an expectation. A _random variable_ with a
distribution has an expectation. The random variable here is the number
of packets the attacker sends. That is the third value in the birthday
attack formula (the number of balls in the second urn).  The probability
you get from the formula is the chance of collision given a certain
number of packets the attacker sends. But in the math you posted, you
arbitrarily set the third parameter to 200. Why?

-Peff