DNS hardening, was Re: Dan Kaminsky

Wed Aug 5 18:38:33 UTC 2009

That is, of course, assuming that SCTP implementations someday clean up their act a bit.  I'm not so sure I'd suggest that they're really ready for "prime time" at this point.

- S

-----Original Message-----
From: Douglas Otis <dotis at mail-abuse.org>
Sent: Wednesday, August 05, 2009 11:13
To: John Levine <johnl at iecc.com>
Cc: nanog at nanog.org <nanog at nanog.org>
Subject: Re: DNS hardening, was Re: Dan Kaminsky

On 8/5/09 9:48 AM, John Levine wrote:
> Other than DNSSEC, I'm aware of these relatively simple hacks to add
> entropy to DNS queries.
>
> 1) Random query ID
>
> 2) Random source port
>
> 3) Random case in queries, e.g. GooGLe.CoM
>
> 4) Ask twice (with different values for the first three hacks) and
> compare the answers

DNSSEC introduces vulnerabilities, such as reflected attacks and
fragmentation related exploits that might poison glue, where perhaps
asking twice might still be needed.

Modern implementations use random 16 bit transaction IDs.  Interposed
NATs may impair effectiveness of random source ports.  Use of random
query cases may not offer an entropy increase in some instances.  Asking
twice, although doubling resource consumption and latency, offers an
increase in entropy that works best when queried serially.

Establishing SCTP as a preferred DNS transport offers a safe harbor for
major ISPs.  SCTP protects against both spoofed and reflected attack.
Use of persistent SCTP associations can provide lower latency than that
found using TCP fallback, TCP only, or repeated queries.  SCTP also
better deals with attack related congestion.

Once UDP is impaired by EDNS0 response sizes that exceed reassembly
resources, or are preemptively dropped as a result, TCP must then
dramatically scale up to offer the resilience achieved by UDP anycast.
In this scenario, SCTP offers several benefits.  SCTP retains
initialization state within cryptographically secured cookies, which
provides significant protection against spoofed source resource
exhaustion.  By first exchanging cookies, the network extends server
state storage.  SCTP also better ensures against cache poisoning whether
DNSSEC is used or not.

Having major providers support the SCTP option will mitigate disruptions
caused by DNS DDoS attacks using less resources.  SCTP will also
encourage use of IPv6, and improve proper SOHO router support.  When
SCTP becomes used by HTTP, this further enhances DDoS resistance for
even critical web related services as well.

-Doug