Re: okay already

--On Monday, March 22, 2010 3:56 PM -0400 Dean Anderson <[email protected]> 
wrote:


> It occurs to me that another effect of the King/Day/Kaminksy/Vixie
> crack-to-make-forgery-consistent patch is that a slew of repeated
> queries will be sent to different nameservers, not all of which might be
> in the path.  By limiting to one query, a successfull interception
> in-path to one nameserver, the attacker is guaranteed to get all the
> queries outstanding.  The patch really does make cracking DNS consistent
> and virtually undetectable.

What you're totally missing, and have been totally misssing, and has been 
tried to explain to you, is that, unpatched, it's MANY orders of magnitude 
*easier* to get false data into the cache and propagated to users.  And 
very few domains have 1 or 2 DNS servers, so you have to guess which one 
the system tries to contact as well.  The patches  greatly decrease the 
likelihood of a successful collision/birthday attack.  Without the patches, 
it's trivial to get garbage data into the cache, and once it's in there, to 
convince the caching resolver to retain that garbage information.  With the 
patches it takes a really large sustained attack to have any probability of 
inserting any rogue data into the DNS Cache.

Quit talking crap about things you don't understand, or worse, don't know 
anything about, it makes you appear really stupid.