Re: DoS and anycast

[Masataka Ohta <mohta@necom830.hpcl.titech.ac.jp>]

Ted Hardie;

> > > Deploying anycast services (outside the RFC-1930 compliant methods
> > > currently in use) lessens the effect of a DoS attack, but at the cost
> > > of risking the integrity of the data provided by the service.
> > 
> > As I pointed it out several times already, anycast root servers
> > is the protection from forged route that the risk of getting
> > forged data is reduced.
> 
> It moves the risk around.

Huh?

Around?

Where is the cost introduced by anycast?

REMEMBER, you said:

	but at the cost of risking the integrity of the data provided
	by the service.

Where is the cost of risking by deploying anycast, when we already
incurs the cost with unicast?

> Let's assume that everyone in the world is
> allowed to grab a copy of the root zone from one canonical place.
> What is to prevent someone injecting a false route to a server
> pretending to be the canonical server, thus provisioning a bad copy of
> the zone to those listening to the route?

Let's admit the fact that everyone in the world is
allowed to grab a copy of a part of the root zone from 13 canonical place.

What is to prevent someone injecting a false route to a server
pretending to be the canonical server, thus provisioning a bad copy of
the part of the zone to those listening to the route?

With anycast root servers, people are free to use public key cryptography
to download the root zone content with https from some canonical places
provided by ICANN, IANA, ALTERNIC, Verisign or whatever, though it merely
moves the risk around to root CAs, such as Verisign.

							Masataka Ohta
#----------------------------------------------------------------------
# To unsubscripbe, send a message to <dnsop-request@cafax.se>.