Subject: Re: diff between -02 and -03 of forgery-resilience

From: Florian Weimer <[email-masked]>
Date: Wed, 23 Jul 2008 14:20:52 +0200

* Yue Luo:

> The draft discusses about the effect of TTL on the vulnerability.
> This assumes that a record in the cache is not overwritten before
> its expiration.  This assumption needs more discussion.  An attacker
> can design ways to "piggy back" records in spoofed responses order
> to overwrite important cache entries.  For example, to attack
> c.isi.edu, the attacker can use packet similar to that in section
> 6.2.7 of RFC 1034.

This has now been disclosed for real by Dan Kaminsky in his Wired
interview.

What about not processing further records which are present in a CNAME
answer in the answer section as some sort of mitigation strategy?  The
downside is that it may cause additional cache misses, which has got a
performance penalty--and traditionally, sending more requests meant
that you increase your spoofing risk.

Another option would be not to overwrite cached data with the
piggy-backed record, but this requires that we put the data at a very
low trust level (below everything listed in RFC 2181, I guess).  It's
also more difficult to implement correctly.

-- 
Florian Weimer                <[email-masked]>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: +49-721-96201-1
D-76133 Karlsruhe             fax: +49-721-96201-99

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Tony Finch <[email-masked]>
Date: Wed, 23 Jul 2008 20:09:27 +0100

> also more difficult to implement correctly.

RFC 2181 says: "when the name sought is an alias only the record
describing that alias is necessarily authoritative. Clients should assume
that other records may have come from the server's cache." (Which I read
as saying that the target data is second-to-least trustworthy.) Does this
still apply if both names are in the same zone? If so, wouldn't that also
defeat Kaminsky's attack?

Not sure why it would be difficult to implement: it's very similar to the
handling of additional data in MX replies, etc.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
FAIR ISLE: SOUTH BACKING SOUTHEAST 4 OR 5, OCCASIONALLY 6 LATER. MODERATE,
OCCASIONALLY ROUGH AT FIRST. OCCASIONAL DRIZZLE WITH FOG PATCHES. MODERATE OR
GOOD, OCCASIONALLY VERY POOR.