[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

DNS hardening, was Re: Dan Kaminsky

Subject: DNS hardening, was Re: Dan Kaminsky
From: fweimer at bfk.de (Florian Weimer)
Date: Thu, 06 Aug 2009 07:11:35 +0000
In-reply-to: <[email protected]> (Douglas Otis's message of "Wed\, 05 Aug 2009 15\:53\:32 -0700")
References: <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]>

* Douglas Otis:

> DNSSEC UDP will likely become problematic.  This might be due to
> reflected attacks,

SCTP does not stop reflective attacks at the DNS level.  To deal with
this issue, you need DNSSEC's denial of existence.  The DNSSEC specs
currently doesn't allow you to stop these attacks dead in your
resolver, but the data is already there.

-- 
Florian Weimer                <fweimer at bfk.de>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstra?e 100              tel: +49-721-96201-1
D-76133 Karlsruhe             fax: +49-721-96201-99

References:
- DNS hardening, was Re: Dan Kaminsky
  - From: johnl at iecc.com (John Levine)
- DNS hardening, was Re: Dan Kaminsky
  - From: dotis at mail-abuse.org (Douglas Otis)
- DNS hardening, was Re: Dan Kaminsky
  - From: rdobbins at arbor.net (Roland Dobbins)
- DNS hardening, was Re: Dan Kaminsky
  - From: dotis at mail-abuse.org (Douglas Otis)
- DNS hardening, was Re: Dan Kaminsky
  - From: morrowc.lists at gmail.com (Christopher Morrow)
- DNS hardening, was Re: Dan Kaminsky
  - From: dotis at mail-abuse.org (Douglas Otis)

Prev by Date: DNS hardening, was Re: Dan Kaminsky
Next by Date: DNS hardening, was Re: Dan Kaminsky
Previous by thread: DNS hardening, was Re: Dan Kaminsky
Next by thread: A DNSSEC irony
Index(es):
- Date
- Thread