Re: DNS over SCTP (was: Re: [Asrg] DNS-based Email Sender Authentication Mechanisms: a Critical Review
In your previous mail you wrote: I thought TCP was the default when the UDP message size is not enough. => with EDNS0 this is a bit more complex but IMHO this is the idea. Note the recommended "connection management" (RFC 1025 4.2.2) suggests multiple queries/responses too. That's, AFAIK, the only advantage of TCP over SCTP: it's already in place and ready. (Yes, one needs to run firewalls and all that stuff.) => this is not a new idea but today no server or resolver implementation supports DNS over SCTP. I have a lot of sympathy for SCTP but for DNS we need a transaction oriented transport, i.e., something more secure than simple stateless query/response over UDP but without the overhead of opening and closing TCP connections. This is a very old idea, cf. RFC 955, but as far as I know this is still an open problem. If I am wrong (I'd like to be :-) please request a BoF in the transport area ASAP! > A single SCTP connection can support thousands of simultaneous streams, I agree SCTP is better, and it's been around for nearly a decade now. => IMHO it is far less than 10 years but arguing about this point is out of topic. Yet, for those who miss it, good old TCP allows, say, a client to hold a couple of connections to its favorite resolver in order to avoid many of the threats illustrated by Kaminsky... => TCP is very expensive in terms of resources for the server and TCP is still vulnerable to in-the-path attacks. > There is also OS support for UDP > tunneling of SCTP when supporting legacy NATs and firewalls. Until > there is an significant incentive to make DNS more robust, use of SCTP > is likely to remain just a good and under appreciated option. It seems that DNS over SCTP would solve 90% of the problems with 10% of the efforts and resources required to implement DNSSEC. However, I hear more often about the latter than the former. How come? => DNSSEC is the only available solution which solves the problems. Others are not available (no specification published in a standard track RFC or simply unfeasible) or don't address the problems (hop-by-hop security for instance, when end-to-end is needed). Both TCP and SCTP are in the others today... Regards [email protected] ___ Ietf mailing list [email protected] https://www.ietf.org/mailman/listinfo/ietf
Re: DNS over SCTP (was: Re: [Asrg] DNS-based Email Sender Authentication Mechanisms: a Critical Review
On Thu, May 28, 2009 at 03:04:19PM +0200, Alessandro Vesely wrote a message of 30 lines which said: > I thought TCP was the default when the UDP message size is not > enough. Well, in theory, it should be EDNS0 (standardized in the previous century) but, in practice, it has deployment issues, like everything which was invented after Jon Postel's death. > It seems that DNS over SCTP would solve 90% of the problems with 10% > of the efforts and resources required to implement DNSSEC. However, > I hear more often about the latter than the former. How come? I've read this message via the IETF general mailing list and so I missed the beginning. In what way can you compare DNSSEC (which provides object security) and SCTP or TCP (which provide a better channel security for DNS)? ___ Ietf mailing list [email protected] https://www.ietf.org/mailman/listinfo/ietf
DNS over SCTP (was: Re: [Asrg] DNS-based Email Sender Authentication Mechanisms: a Critical Review
Douglas Otis wrote: Just using TCP would prevent most of the DNS poisoning attacks that Amir's paper reports. TCP is prone to DDoS attack. As such, TCP is seldom used with DNS. I thought TCP was the default when the UDP message size is not enough. That's, AFAIK, the only advantage of TCP over SCTP: it's already in place and ready. (Yes, one needs to run firewalls and all that stuff.) A single SCTP connection can support thousands of simultaneous streams, I agree SCTP is better, and it's been around for nearly a decade now. Yet, for those who miss it, good old TCP allows, say, a client to hold a couple of connections to its favorite resolver in order to avoid many of the threats illustrated by Kaminsky... There is also OS support for UDP tunneling of SCTP when supporting legacy NATs and firewalls. Until there is an significant incentive to make DNS more robust, use of SCTP is likely to remain just a good and under appreciated option. It seems that DNS over SCTP would solve 90% of the problems with 10% of the efforts and resources required to implement DNSSEC. However, I hear more often about the latter than the former. How come? ___ Ietf mailing list [email protected] https://www.ietf.org/mailman/listinfo/ietf
