Re: [dnsext] IP fragmentation security

Nicholas Weaver <nweaver@ICSI.Berkeley.EDU> Mon, 01 June 2009 20:56 UTC

Cc: Matthew Dempsky <matthew@dempsky.org>, George Barwood <george.barwood@blueyonder.co.uk>, "<namedroppers@ops.ietf.org>" <namedroppers@ops.ietf.org>
Message-Id: <4B0687DD-C979-4FC6-A32F-48ABC411B9D9@ICSI.Berkeley.EDU>
From: Nicholas Weaver <nweaver@ICSI.Berkeley.EDU>
To: Nicholas Weaver <nweaver@ICSI.Berkeley.EDU>
In-Reply-To: <375691A7-70D9-47A9-BAC4-440D82702442@ICSI.Berkeley.EDU>
Content-Type: text/plain; charset="US-ASCII"; format="flowed"; delsp="yes"
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0 (Apple Message framework v935.3)
Subject: Re: [dnsext] IP fragmentation security
Date: Mon, 01 Jun 2009 13:52:03 -0700
References: <8FA88E5DED3E4E16A214AEAAB4AC755C@localhost> <ACCD92CF-ABF2-4A29-B4E1-0C4F25C5DE43@icsi.berkeley.edu> <ADED5A71-1B52-4D60-AEB2-A3CCFD12B6A5@ICSI.Berkeley.EDU> <F5BA13EB-C222-46C9-B5AE-426243867276@dempsky.org> <375691A7-70D9-47A9-BAC4-440D82702442@ICSI.Berkeley.EDU>
Sender: owner-namedroppers@ops.ietf.org
Precedence: bulk

On Jun 1, 2009, at 1:26 PM, Nicholas Weaver wrote:

>
> On Jun 1, 2009, at 1:24 PM, Matthew Dempsky wrote:
>
>> Another comment: the attacker also has to forge the UDP checksum,  
>> which includes the source port and txid, but is itself only 16  
>> bits. On the other hand, the attacker doesn't have to bother  
>> repeating the query name, so it opens the possibility for a  
>> birthday attack.
>>
>> Does anyone know any DNSSEC enabled zones containing wildcard names  
>> with large recordsets?
>
> OH, good point.  Forgot about the UDP checksum.
>
> So you're right, this will fail because the checksum includes the  
> exisiting entropy sources.

Oh wait: here's the math:

Its 2^16 regardless of the entropy sources (port, 0x20, ID, etc):

The checksum is a 2^16 value.  The attacker must match:

a)  The IPID (predictable or 1 in 2^16, but assume predictible)

b)  The checksum (1 in 2^16, matched by basically having a random 16b  
value somewhere in the attacker's fragment, as this checksum includes  
both port and TXID and 0x20, and if the attacker knew those, he could  
respond directly))

However, the attacker gets only one try per query, since the first  
packet which matches IPID is used to be in the checksum (a checksum  
failure will mean a dropped UDP packet, not a "retry assembly" I'm  
assuming).

So its not kaminski-level even when it under conditions that work  
(authority sends a large, fragmented response with a predictable  
IPID), because although its a glue race-until-win style attack, you  
can only generate only one attack packet per query, which means ~2^16  
queries to generate a successful attack, and you need to be  
effectively sequential to keep the IPID predictable.

The same glue policy countermeasures against Kaminski attacks also  
works here, BTW.

Apologies for my stupidities.

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

Re: [dnsext] IP fragmentation security Nicholas Weaver
Re: [dnsext] IP fragmentation security Nicholas Weaver
Re: [dnsext] IP fragmentation security Nicholas Weaver
Re: [dnsext] IP fragmentation security Alex Bligh
Re: [dnsext] IP fragmentation security Matthew Dempsky
Re: [dnsext] IP fragmentation security Matthew Dempsky
Re: [dnsext] IP fragmentation security Nicholas Weaver
Re: [dnsext] IP fragmentation security Nicholas Weaver
Re: [dnsext] IP fragmentation security Douglas Otis
Re: [dnsext] IP fragmentation security Nicholas Weaver
Re: [dnsext] IP fragmentation security Matthew Dempsky
Re: [dnsext] IP fragmentation security Douglas Otis