Re: OFFTOPIC: DNSSEC groupthink versus improving DNS

[Brian Dickson <[e-mail]>]

Duane wrote:
> Mark Andrews wrote:
>
>   
>> 	Well we could stop caching any DNS data.  That's the only
>> 	way to make it match the credit card industry model where
>> 	changes are instantly available.
>>     
>
> Anyone have any idea how many credit card transactions per second occur?
>
>   

Ballpark figure - 6.5 B people, 10 transactions per day average, gives ~ 
1M/s worldwide.

There are about 1.5M unique hosts seen at the root and TLD servers per 
day, most are caching resolvers.

If the rates were comparable, each resolver would process ~ 1 
query/second. Off by several orders of magnitude.

> Seems to me they are very similar in topology, so even if you only
> cached information for a small amount of time that would mitigate most
> attacks people seem to be so concerned about at present.
>
>   

Sorry, the details on the attack methods and vectors means you would 
throw away good answers more often
than you would throw away bad answers (from the cache), but an empty 
cache for a given domain is an extra vector.

Long TTLs are your friend. That those happen to benefit scaling is a 
bonus, not an assumption.

Here's a clue - credit card transactions are in effect only signed in 
real-time, not processed per se.
The actual transactions are still batch processed much later.
This is in part to avoid data leakage through the authentication process 
itself.

So, DNSSEC is already pretty similar to CC's, just with better scaling 
properties and less overhead.

> Since the window of opportunity for these sort of attacks would be
> greatly reduced, the cost to commit these types of attacks would greatly
> increase if not be virtually impossible to commit on any kind of scale
> worth doing, so problem solved.
>
>   
Not.

Brian


--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>