Subject: Re: Is this a possible DoS scenario within DNSSEC ?

From: Olafur Gudmundsson <[email-masked]>
Date: Tue, 25 Jul 2000 13:36:55 -0400

At 08:10 AM 7/25/00, Roy Arends wrote:
>Hello,
>
>A SIG record covers RR Sets. Consider a caching server (not secured),
>which has cached the following:
>
>example.org.  NS  ns1.example.org.
>example.org.  NS  ns2.example.org.
>example.org.  SIG NS DSA .....
>
>The SIG above validates the two NS records. At one point the cache
>gets spoofed with for instance:
>
>example.org.  NS  very.ugly.org.
>
>Upon a query for these records, the cache server will respond with all 3
>NS records and the SIG record.
>
>The secure resolver validates the NS RR set with the SIG record, and its
>conclusion will be that the SIG record does not authenticate the 3 NS
>records.
>
>The secure resolver now disregards these NS records (they are seen as
>BAD). This zone can not be resolved. If this scheme is true, this is an
>easy to perform denial of service attack against the example.org zone.
>
>Is this a possible scenario ?

Yes it is quite likely and the only thing that can be done is to
have resolvers that will check if the data came from caching or
authoritative server. If the resolver did not get the data from an
authoritative server it MUST try to get the data from one and hope that
it can reach it and it gets a better answer.

This is one of the operational issues that DNSSEC, traffic to authoritative
servers will increase significantly. And DNSSEC may not work well if
resolvers are stuck behind a non DNSSEC capable forwarder.

         Olafur

>Regards,
>
>Roy Arends
>NLnet Labs.
>
>
>
>
>
>
>
>
>
>
>to unsubscribe send a message to [email-masked] with
>the word 'unsubscribe' in a single line as the message text body.

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: [email-masked] (Ted Lindgreen)
Date: Wed, 26 Jul 2000 00:22:42 +0200

[Quoting Olafur Gudmundsson, on Jul 25, 20:16, in "Re: Is this a possib ..."]

> > <A possible DoS attack scenario>

> it can reach it and it gets a better answer.

I do not think it is good to recommend, and certainly not make it
a MUST, that everyone always tries to go to the authoritative
servers in order to check for possibly better answers.
This defeats the whole idea of the distributed mechanisme of the
DNS service, and it is just that, which has made it so powerful
and scalably as it has proven to be.

> servers will increase significantly. ....

Hopefully not, it may kill the large TLDs, and thus the Internet.

But please note, that only non-DNSSEC caching servers can be
fooled: secure aware caching servers will discover the spoofed data
as being bad upon entry, and must discard it immediately.

So, it is really not necessary to go straight to the authoritive
server, consulting your favourite secure aware caching server is
just as good.

> resolvers are stuck behind a non DNSSEC capable forwarder.

Absolutely, and the real lessons are therefore clear:
- Secure aware resolvers should not use non secure aware
  caching servers as forwarder.
- Maintainers of important forwarding servers, e.g. the large
  ISPs, need to be convinced that they must implement DNSSEC 
  as soon as it starts being deployed, if they care for their
  customers.

Regards,
-- Ted.