Re: Quick Poll: Would you trust system software from an anonymous source?

Dean Anderson <[email protected]> wrote:
> The attack on BIND took on 65536 packets for brute force; easily
> possible on the //first try// on a LAN.

What if the attacker isn't on the LAN?

> There is no way that the "birthday attack window" can be closed, and the
> effort required can't be increased without adding more random bits in
> the packet.

Would you agree that a birthday-based attack is easier when the
resolver has a larger number of outstanding queries for the same
record?  And so reducing the number of such outstanding queries (say,
to only 1) makes such an attack more difficult?

> Fooling around with how the server manages ports

I saw Dan Kaminsky talking about that in a message you quoted.  As I
said, while I understand what he was saying, I don't think I agree
with it.

But I don't think I've seen anything like that from Kevin Day or Jeff
King.  The approach taken in Jeff's patch is actually the same as one
of your own suggestions from 2008.

http://article.gmane.org/gmane.network.djbdns/13518 :
>>> one could try to queue up the list of clients making the same
>>> query and answer all when the query is resolved.

Those are your words, and that's exactly what Jeff's patch does.


paul