Re: [Asrg] DNS over SCTP

Alessandro Vesely <vesely@tana.it> Wed, 12 August 2009 07:43 UTC

Return-Path: <vesely@tana.it>
X-Original-To: asrg@core3.amsl.com
Delivered-To: asrg@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E4E4A3A6821 for <asrg@core3.amsl.com>; Wed, 12 Aug 2009 00:43:30 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.917
X-Spam-Level:
X-Spam-Status: No, score=-3.917 tagged_above=-999 required=5 tests=[AWL=0.802, BAYES_00=-2.599, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CQC47A76roZJ for <asrg@core3.amsl.com>; Wed, 12 Aug 2009 00:43:30 -0700 (PDT)
Received: from wmail.tana.it (mail.tana.it [62.94.243.226]) by core3.amsl.com (Postfix) with ESMTP id C43B93A67C2 for <asrg@irtf.org>; Wed, 12 Aug 2009 00:43:29 -0700 (PDT)
Received: from [172.25.197.158] (pcale.tana [172.25.197.158]) (AUTH: CRAM-MD5 ale@tana.it, TLS: TLS1.0, 256bits, RSA_AES_256_CBC_SHA1) by wmail.tana.it with esmtp; Wed, 12 Aug 2009 09:29:05 +0200 id 00000000005DC036.000000004A826F41.000024F0
Message-ID: <4A826F42.3090903@tana.it>
Date: Wed, 12 Aug 2009 09:29:06 +0200
From: Alessandro Vesely <vesely@tana.it>
User-Agent: Thunderbird 2.0.0.22 (Windows/20090605)
MIME-Version: 1.0
To: AJ Jaghori <ciscoworkz@gmail.com>
References: <003d01c9dd01$bf3531d0$800c6f0a@china.huawei.com> <3be421270905250718y5d62f6d5odb6f2bebecf418d0@mail.gmail.com> <6684E747-55CB-4BB3-B838-9F4FE906AFE7@mail-abuse.org> <200905251603.MAA16221@Sparkle.Rodents-Montreal.ORG> <CCE0A3E1-4BCB-460C-AEA0-6548BB4AE8FE@mail-abuse.org> <4A1D64C9.5060505@tana.it> <47BC2197-472E-4615-97D2-F7E42B8F3B7D@mail-abuse.org> <4A1E8BD3.8000103@tana.it> <20090528131509.GA13521@nic.fr> <4A1E9CBF.4010703@tana.it> <be653210908112047x4f4075cfu70611559b99cbe08@mail.gmail.com>
In-Reply-To: <be653210908112047x4f4075cfu70611559b99cbe08@mail.gmail.com>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 8bit
Cc: Anti-Spam Research Group - IRTF <asrg@irtf.org>, ietf@ietf.org
Subject: Re: [Asrg] DNS over SCTP
X-BeenThere: asrg@irtf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: Anti-Spam Research Group - IRTF <asrg@irtf.org>
List-Id: Anti-Spam Research Group - IRTF <asrg.irtf.org>
List-Unsubscribe: <http://www.irtf.org/mailman/listinfo/asrg>, <mailto:asrg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/asrg>
List-Post: <mailto:asrg@irtf.org>
List-Help: <mailto:asrg-request@irtf.org?subject=help>
List-Subscribe: <http://www.irtf.org/mailman/listinfo/asrg>, <mailto:asrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Wed, 12 Aug 2009 07:43:31 -0000

AJ Jaghori wrote:
> This is a common misconception.  DNS over SCTP will not solve 90% of the 
> problems!

Why?

Attackers are able to guess what DNS queries an SMTP server would put 
as a consequence of a client connection. Even after the Kaminsky fix, 
that leaves room for brute force attacks. If queries were run over 
TCP, the additional requirement to hijack a TCP connection would 
reduce the probabilities enough, even for today's botnets. Thus, using 
TCP would solve those security issues. (Is that 90%?) It would 
introduce some inefficiency, though. (More than DNSSEC?)

SCTP provides for several streams over a single connection, streams 
are asynchronous with one another like UDP packets, but are reliably 
connected and secured like TCP streams. With decent keep-alive 
directives, that would allow a client to be connected with a pool of 
relevant resolvers, thereby avoiding the inefficiencies that TCP would 
introduce.

> On Thu, May 28, 2009 at 10:16 AM, Alessandro Vesely <vesely@tana.it 
> <mailto:vesely@tana.it>> wrote:
> 
>     Stephane Bortzmeyer wrote:
> 
>        It seems that DNS over SCTP would solve 90% of the problems with 10%
>        of the efforts and resources required to implement DNSSEC. However,
>        I hear more often about the latter than the former. How come?
> 
> 
>    I've read this message via the IETF general mailing list and so I
>    missed the beginning. In what way can you compare DNSSEC (which
>    provides object security) and SCTP or TCP (which provide a better
>    channel security for DNS)?
> 
> 
> The discussion was about how to get rid of the threats illustrated,
> e.g., in Kaminsky, D.: "It’s the end of the cache as we know it."
> In: Black Hat conference (2008). Online at http://www.doxpara.com/DMK_BO2K8.ppt