Subject: RE: hopefully was RE: dictionary attack on nameservers

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 17 Aug 2004 12:40:35 -0700

> My question remains:
>      Is there a way to prove the non-existence of a name without
>     A     - exposing any of the contents of the zone?
>     B    - muddying up the name space with fake names or data sets?
>     C    - on-line cryptographic operations?
>     D    - being vulnerable to replay attacks of the negative answer?

OK, lets look at B vs C.

Let xyz.example.com be the query. There are two basic approaches:

1) The client asks for xyz, the server calculates H(xyz) and returns a
signed entry saying that there is no entry between x & y where x < H(xyz) <
y.

2) The client calculates H(xyz) and makes a request for that record, the
server returns a record for x, stating that the next record is y.

The difference here is that in (1) the client performs the hash function, in
(2) the server performs the hash function.

Remember that we are talking about a hash function here, not a signature.
These are realtively fast. We could imagine performing TSIG on each record.
This is the same type of issue. 

There is an issue of asymmetric computational requirements. The attacker can
force the server to perform a disproportionate amount of work.

What we could do is to create a query that was for the NSEC record but
always returned an additional record response from the apex.

Ie. to ask for xyz, the server sends a query asking for:

A-(xyz.example.com) NSEC2 -(H(xyz).example.com) 

The response is:

xyz.example.com - NotExist  example.com - NSEC2 (x,y)

So there is no node _x.example.com or _y.example.com and in this scheme the
client is required to do the crypto. The server does not do any crypto, nor
does the server contain any additional nodes.

You do however need to ensure that the response to the query for NSEC2
-(H(xyz).example.com) makes it back and the DNS server needs to be able to
understand the NSEC2 query

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Edward Lewis <[email-masked]>
Date: Tue, 17 Aug 2004 16:44:08 -0400

>Let xyz.example.com be the query. There are two basic approaches:

A DNS query consists of (name, type, class).  You can't query for just a name.
A petty point this may be, but really, the type is needed in any 
example.  (We've wasted much time before when we didn't consider the 
type in the query.)

>server returns a record for x, stating that the next record is y.

I don't understand why the client would request anything related to 
the hash of the desired name.  Is client assuming the data it wants 
isn't there?

>(2) the server performs the hash function.

Is this backwards?  In (1) you mention "server calculates" and here 
you say "client performs."

>This is the same type of issue.

I really don't think the issue is the computation of the hash.  Does 
anyone think it's the issue?  (There's an issue with generating the 
public key signature record with 'C' above.)

>A-(xyz.example.com) NSEC2 -(H(xyz).example.com)

"Server sends a query" has me confused, and then what is the next 
line?  It looks like your "query" has RDATA.

>xyz.example.com - NotExist  example.com - NSEC2 (x,y)

Totally confused by that.  What is the RRTYPE?  Is NotExist a new RCODE?

>understand the NSEC2 query

I though you were comparing B and C.  Are you saying that extra names 
is more/equal/less palatable than on-server cryptography?

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

"I can't go to Miami.  I'm expecting calls from telemarketers." -
Grandpa Simpson.