Re: increasing DNS message entropy, a solution for NATs

[Joe Abley <[e-mail]>]

On 21 Jul 2008, at 07:17, Roy Arends wrote:

> A simple, straightforward method to increase entropy in DNS message
> transaction, is to query for the same name twice (or N times for  
> even more
> increased entropy) and require that the answers be the same. This does
> require a change to the resolver, but not to the authoritative server.

This will lead to trouble if the query is ever answered by one of a  
cluster of servers, where there is the potential for some servers in  
the cluster to be slightly more up-to-date than others.

It also might lead to trouble if the query is ever answered by a  
single-source server which updates between query i and query j for  
some j>i.

> There are a few things to consider, such as auth-servers not  
> agreeing on
> zone content (or other protocol violations), or avoiding birthday  
> paradox
> when sending two queries to the same server, but overall, this  
> solution is
> an alternative for those deployments that are not capable of making  
> use of
> source port randomization.


Joe

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>