Subject: Re: DNS Blackhole attack

From: Robert Martin-Legene <[email-masked]>
Date: Wed, 27 Apr 2005 09:51:16 +0200

On 7/Mar/05, Johan Ihrén <[email-masked]> wrote:
> As most of you know for a signed delegation the referral will contain
> NS RRset for the child + DS for the child + RRSIG(DS) + possibly some
> glue. The RRSIG(DS) enables the validator to verify whether the data
> from the child is authentic or not regardlesss of whether it arrived
> from the right servers or not. I.e. it will work just fine even if the
> glue is spoofed as long as the bad guy serves data that validate.

I've been reading this paragraph a number of times, and it also looked
very clear in the RFC. I'm just still wondering if it is or isn't
possible to do a DoS in terms of putting lame glues out there.

If I MiM replies from .tld-servers regarding fish.tld and remove the
glues, inserting my own with a high TTL. Wouldn't fish.tld then be
unreachable?

-- Robert Martin-Legene,
   .DK

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Olaf M. Kolkman" <[email-masked]>
Date: Wed, 27 Apr 2005 11:34:11 +0200

On Wed, 27 Apr 2005 09:51:16 +0200

>  possible to do a DoS in terms of putting lame glues out there.

It is still possible to do a DoS attack. DNSSEC will not protect
against DOS attacks.

The ultimate DOS attack would be if the "Man in the Middle" would just
strip al the glue. The client would (assuming that the glue is
critical i.e.  all nameservers are in bailiwick) not be able to
contact any of the authoritative nameservers.

-- Olaf

---------------------------------| Olaf M. Kolkman
---------------------------------| RIPE NCC
---------------------------------| JID: olaf at jabber.secret-wg.org