ietf-asrg
[Top] [All Lists]

Re: [Asrg] DNS over SCTP

2009-08-12 03:43:46
AJ Jaghori wrote:
This is a common misconception. DNS over SCTP will not solve 90% of the problems!

Why?

Attackers are able to guess what DNS queries an SMTP server would put as a consequence of a client connection. Even after the Kaminsky fix, that leaves room for brute force attacks. If queries were run over TCP, the additional requirement to hijack a TCP connection would reduce the probabilities enough, even for today's botnets. Thus, using TCP would solve those security issues. (Is that 90%?) It would introduce some inefficiency, though. (More than DNSSEC?)

SCTP provides for several streams over a single connection, streams are asynchronous with one another like UDP packets, but are reliably connected and secured like TCP streams. With decent keep-alive directives, that would allow a client to be connected with a pool of relevant resolvers, thereby avoiding the inefficiencies that TCP would introduce.

On Thu, May 28, 2009 at 10:16 AM, Alessandro Vesely <vesely(_at_)tana(_dot_)it <mailto:vesely(_at_)tana(_dot_)it>> wrote:

    Stephane Bortzmeyer wrote:

       It seems that DNS over SCTP would solve 90% of the problems with 10%
       of the efforts and resources required to implement DNSSEC. However,
       I hear more often about the latter than the former. How come?


   I've read this message via the IETF general mailing list and so I
   missed the beginning. In what way can you compare DNSSEC (which
   provides object security) and SCTP or TCP (which provide a better
   channel security for DNS)?


The discussion was about how to get rid of the threats illustrated,
e.g., in Kaminsky, D.: "It’s the end of the cache as we know it."
In: Black Hat conference (2008). Online at http://www.doxpara.com/DMK_BO2K8.ppt
_______________________________________________
Asrg mailing list
Asrg(_at_)irtf(_dot_)org
http://www.irtf.org/mailman/listinfo/asrg

<Prev in Thread] Current Thread [Next in Thread>