Subject: Re: Is this a possible DoS scenario within DNSSEC ?

From: [email-masked] (Ted Lindgreen)
Date: Wed, 26 Jul 2000 00:22:42 +0200

[Quoting Olafur Gudmundsson, on Jul 25, 20:16, in "Re: Is this a possib ..."]
> At 08:10 AM 7/25/00, Roy Arends wrote:

> > <A possible DoS attack scenario>

> >Is this a possible scenario ?
> 
> Yes it is quite likely and the only thing that can be done is to
> have resolvers that will check if the data came from caching or
> authoritative server. If the resolver did not get the data from an
> authoritative server it MUST try to get the data from one and hope that
> it can reach it and it gets a better answer.

I do not think it is good to recommend, and certainly not make it
a MUST, that everyone always tries to go to the authoritative
servers in order to check for possibly better answers.
This defeats the whole idea of the distributed mechanisme of the
DNS service, and it is just that, which has made it so powerful
and scalably as it has proven to be.

> This is one of the operational issues that DNSSEC, traffic to authoritative
> servers will increase significantly. ....

Hopefully not, it may kill the large TLDs, and thus the Internet.

But please note, that only non-DNSSEC caching servers can be
fooled: secure aware caching servers will discover the spoofed data
as being bad upon entry, and must discard it immediately.

So, it is really not necessary to go straight to the authoritive
server, consulting your favourite secure aware caching server is
just as good.

> servers will increase significantly. And DNSSEC may not work well if
> resolvers are stuck behind a non DNSSEC capable forwarder.

Absolutely, and the real lessons are therefore clear:
- Secure aware resolvers should not use non secure aware
  caching servers as forwarder.
- Maintainers of important forwarding servers, e.g. the large
  ISPs, need to be convinced that they must implement DNSSEC 
  as soon as it starts being deployed, if they care for their
  customers.

Regards,
-- Ted.

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: "Matt Crawford" <[email-masked]>
Date: Wed, 26 Jul 2000 08:41:56 -0500

I suppose a clever implementation with cycles to spare might try
every subset of an rrset whose SIG was found to be bad ...