[Crisp] IRIS-LWZ and security issues due to spoofed sources

There have been a lot of discussions going on in the last few days
at NANOG and other dns operations lists that are related to issue of
public recursive dns servers being used way to amplify an attack:
  http://www.gossamer-threads.com/lists/nanog/users/89657
  http://lists.oarci.net/pipermail/dns-operations/2006-February/thread.html

The general description of the problem is that bad guys are sending
spoofed udp packets to servers in a way so that the servers would send 
data (to spoofed source) that is considerably larger then the original 
request - thus the amplification. For more information, you may want 
to read http://www.us-cert.gov/reading_room/DNS-recursion121605.pdf

Now it occurs to me that the same problem may also happen with those
using IRIS-LWZ UDP method as IRIS response is very likely to be larger 
then original request and thus there is a possibility of amplification.

So before its too late and IRIS-LWS draft is published as an RFC,
I think we need to have this possiblity documented in the Security 
Considerations section (which is rather small right now...) and try
to come up with some suggestions on how to deal with the problem when 
people want to run public IRIS server.

---
William Leibzon
   mailto: william@completewhois.com
Anti-Spam and Email Security Research Worksite:
   http://www.elan.net/~william/emailsecurity/
Whois & DNS Network Investigation Tools:
   http://www.completewhois.com

_______________________________________________
Crisp mailing list
Crisp@ietf.org
https://www1.ietf.org/mailman/listinfo/crisp