[ietf-dkim] draft-ietf-dkim-threats-02 nit//Packet Amplification
Douglas Otis <dotis@mail-abuse.org> Thu, 06 April 2006 19:27 UTC
Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1FRa8g-0001Ja-8o for ietf-dkim-archive@lists.ietf.org; Thu, 06 Apr 2006 15:27:30 -0400
Received: from sb7.songbird.com ([208.184.79.137]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1FRa8f-0004Iq-TR for ietf-dkim-archive@lists.ietf.org; Thu, 06 Apr 2006 15:27:30 -0400
Received: from sb7.songbird.com (sb7.songbird.com [127.0.0.1]) by sb7.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id k36J5S1O026584; Thu, 6 Apr 2006 12:05:28 -0700
Received: from a.mail.sonic.net (a.mail.sonic.net [64.142.16.245]) by sb7.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id k36J3HSr026153 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for <ietf-dkim@mipassoc.org>; Thu, 6 Apr 2006 12:03:17 -0700
Received: from [168.61.10.151] (SJC-Office-DHCP-151.Mail-Abuse.ORG [168.61.10.151]) (authenticated bits=0) by a.mail.sonic.net (8.13.6/8.13.3) with ESMTP id k36J2GBD016181 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NO) for <ietf-dkim@mipassoc.org>; Thu, 6 Apr 2006 12:02:41 -0700
Mime-Version: 1.0 (Apple Message framework v749.3)
Content-Transfer-Encoding: 7bit
Message-Id: <A73DB92F-7106-43C2-96A4-97E7C510A6AB@mail-abuse.org>
Content-Type: text/plain; charset="US-ASCII"; delsp="yes"; format="flowed"
To: IETF-DKIM <ietf-dkim@mipassoc.org>
From: Douglas Otis <dotis@mail-abuse.org>
Date: Thu, 06 Apr 2006 12:03:03 -0700
X-Mailer: Apple Mail (2.749.3)
X-Songbird: Clean, Clean
Subject: [ietf-dkim] draft-ietf-dkim-threats-02 nit//Packet Amplification
X-BeenThere: ietf-dkim@mipassoc.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: IETF DKIM Discussion List <ietf-dkim.mipassoc.org>
List-Unsubscribe: <http://mipassoc.org/mailman/listinfo/ietf-dkim>, <mailto:ietf-dkim-request@mipassoc.org?subject=unsubscribe>
List-Archive: <http://mipassoc.org/pipermail/ietf-dkim>
List-Post: <mailto:ietf-dkim@mipassoc.org>
List-Help: <mailto:ietf-dkim-request@mipassoc.org?subject=help>
List-Subscribe: <http://mipassoc.org/mailman/listinfo/ietf-dkim>, <mailto:ietf-dkim-request@mipassoc.org?subject=subscribe>
Sender: ietf-dkim-bounces@mipassoc.org
Errors-To: ietf-dkim-bounces@mipassoc.org
X-SongbirdInformation: support@songbird.com for more information
X-Songbird-From: ietf-dkim-bounces@mipassoc.org
X-Spam-Score: 0.0 (/)
X-Scan-Signature: 97adf591118a232206bdb5a27b217034
,---- |4.3.1. Packet Amplification Attacks via DNS | | DKIM contributes indirectly to this attack by requiring the | publication of fairly large DNS records for distributing public keys. | The names of these records are also well known, since the record | names can be determined by examining properly-signed messages. This | attack does not have an impact on DKIM itself. DKIM, however, is not | the only application which uses large DNS records, and a DNS-based | solution to this problem will likely be required. '____ DKIM might directly contribute to a packet amplification attack. When an unlimited number signatures are evaluated or a label tree must be traversed for a list of email-address domains, the level of targeted network traffic must be considered. Change to: | DKIM contributes indirectly to this attack by requiring the | publication of fairly large DNS records for distributing public keys. | When published with a wildcard label, the impact these keys might | have increases when being exploited. DKIM may directly lead to an | amplification attack without ensuring reasonable limits upon the | number of verifications per message or the nature of the DNS | transaction. While DKIM is not the only application using large DNS | records, caution is required as regulating DNS traffic is problematic. _______________________________________________ NOTE WELL: This list operates according to http://mipassoc.org/dkim/ietf-list-rules.html
- [ietf-dkim] draft-ietf-dkim-threats-02 nit//Packeā¦ Douglas Otis