Re: distributed.net and seti@home

[atatat () ATATDOT NET (Andrew Brown)]

> One of the things which also protects you against ID prediction (more
> so than a random ID), is random source ports for each query.  I
> believe that BIND does this now.  I recall someone mentioning
> problems configuring their network, as BIND was no longer using
> source port 53.  This causes other nightmares, but it goes a long way
> to prevent spoofing.

bind 8 has several things you can do to get around this.  by default,
bind 8 uses a single port (not 53) for outbound queries (to fulfill
recursive lookups not already in the cache).  and by default bind (in
general) uses monotonically increasing query ids.

however...you can simply add

options {
        query-source address * port *;
        use-id-pool yes;
};

and you're much better off.  the use-id-pool one refers to a
precalculateds set of query ids, but not a random set.  random query
ids would be very vulnerable to a birthday attack, requiring about 100
outstanding queries before there's a 50% chance that an id gets
reused.  use-id-pool uses a query id and shuffles it back into the
pool, but far from the current "surface".

--
|-----< "CODE WARRIOR" >-----|
codewarrior () daemon org             * "ah!  i see you have the internet
twofsonet () graffiti com (Andrew Brown)                that goes *ping*!"
andrew () crossbar com       * "information is power -- share the wealth."