| |||||||||||||
Some stupid ideasSome stupid ideasPosted Aug 14, 2008 10:08 UTC (Thu) by NAR (subscriber, #1313)In reply to: Some stupid ideas by njs Parent article: Details of the DNS flaw revealed I think this is a good idea. RFC 1035 states that "TTL is a 32 bit signed integer that specifies the time interval that the resource record may be cached", so this actually would not break the DNS specification.
(Log in to post comments)
Some stupid ideas Posted Aug 14, 2008 10:51 UTC (Thu) by rvfh (subscriber, #31018) [Link] In this case, one could ask for each value (or only the ones under attack) twice: - ask value, return to requester with short TTL (a few seconds) - wait a bit - ask value again, if matches use given TTL (or limit it to a few hours) Anyway, it seems the solution is in the repetition, to decrease the probability of success of the attack.
|
|||||||||||||