Chapter 8 --------- 8. Because s is short, an exhaustive search conducted by generating all possible s and comparing the MD5 checksums with m would be straightforward. Sending MD5(s_r), for some random or time-dependent r, would suffice to defeat this search strategy, but note that now we would have to remember r and be able to present it later to show we knew s. Using RSA to encrypt s_r would be better in that sense, because we could decrypt it at any time and verify s without remembering r. 11. The problem with padding each 1-byte message with seven zero bytes before encrypting is that we now are transmitting only 256 possible different encrypted blocks and a codebreaking attack is quite straightforward. Here are some better options. Each involves encrypting a full block for each plaintext byte transmitted; the first two also require that we transmit a full block. a. We could pad each plaintext byte with 7 random bytes before encrypting. This is quite effective, if the random bytes are truly random. b. We could make use of cipher block chaining, as in Figure 8.7, padding each plaintext byte p_i with seven zero-bytes before xoring with the previous Cipher i-1 block. A roughly equivalent alternative, perhaps more like the previous option, is to pad p_i with seven bytes from Cipher i-1, and omit the xor. 18. R1 blocks inbound traffic to the telnet port, unless the destination subnet is net2. R2 blocks all telnet traffic from net 2 to net 1. 19. The primary reason for filtering outbound traffic is if it is clearly malicious or malformed. For example, if source addresses are not from the local domain (ie. spoofed), then the traffic is highly likely to be malicious. Chapter 9 --------- 4. There is little if any relationship, formally, between a domain and an IP network, although it is nonetheless fairly common for an organization (or department) to have its DNS server resolve names for all the hosts in its network (or subnet), and no others. The DNS server for cs.princeton.edu could, however, be on a different network entirely (or even on a different continent) from the hosts whose names it resolves. Alternatively, each x.cs.princeton.edu host could be on a different network, and each host that is on the same network as the cs.princeton.edu nameserver could be in a different DNS domain.If the reverse-mapping PTR records are used, however, then the same nameserver can handle both forward and reverse lookups only when DNS zones do correspond to groups of subnets. 10. If we just move the .com entries to the root nameserver, things wouldn t be much different than they are now, in practice. In theory, the root nameservers now could refer all queries about the .comzone to a set of .com-specific servers; in practice the root nameservers (x.rootservers. net for x from a to m) all do answer .com queries directly. (They do not, however, answer .int queries directly.) The proposal here simply makes this current practice mandatory, and shouldn't thus affect current traffic at all, although it might leave other zones such as .org and .net and .edu with poorer service someday in the future. The main problem with moving the host-level entries, such as for www.cisco, to a single root nameserver entry such as cisco, is that this either limits organizations to a single externally visible host, or else (if the change is interpreted slightly differently) significantly increases root nameserver traffic as it returns some kind of block of multiple host addresses. In effect this takes DNS back to a single central server. Perhaps just as importantly, the updating of the IP addresses corresponding to host names is now out of the hands of the organizations owning the host names, leading to a considerable administrative bottleneck. However, if we re just browsing the web and need only one address for each organization, the traffic would be roughly equivalent to the way DNS works now. (We are assuming that local resolvers still exist and still maintain request caches; the loss of local caches would put an intolerable burden on the root nameservers.) 11. DNS records contain a TTL value, specified by the DNS server, representing how long a DNS record may be kept in the client cache. RFC 1034 puts it this way: "If a change can be anticipated, the TTL can be reduced prior to the change to minimize inconsistency during the change, and then increased back to its former value following the change." 12. Strictly speaking one also needs to specify authoritative answers only; otherwise a nameserver that holds the final answer in its cache will supply that answer even if norecurse was specified. In practice it suffices to search for NS records for partial domains: edu., princeton. edu., and cs.princeton.edu., and to send each query to the nameserver returned in the NS record for the preceding query. 15. Existing SMTP headers that help resist forgeries include mainly the Received: header, which gives a list of the hosts through which the message has actually passed, by IP address. A mechanism to identify the specific user of the machine (as is provided by the identd service), would also be beneficial. 22. When the server initiates the close, then it is the server that must enter the TIMEWAIT state. This requires the server to keep extra records; a server that averaged 100 connections per second would need to maintain about 6000 TIMEWAIT records at any one moment. HTTP 1.1 has a variable-sized message transfer mechanism; the size and endpoint of a message can be inferred from the headers. The server can thus transfer a file and wait for the client to detect the end and close the connection. Any request-reply protocol that could be adapted to support arbitrarily large messages would also suffice here. 24. One server may support multiple web sites with multiple hostnames, a technique known as virtual hosting. HTTP GET requests are referred by the server to the appropriate directory based on the hostname contained in the request. 26. (a) Enabling arbitrary SMTP relaying allows spammers to send unsolicited email via someone else s machine. (b) One simple solution to this problem would be the addition of a password option as part of the opening SMTP negotiation. (c) As of 1999, most solutions appear to be based on some form of VPN, or IP tunneling, to make ones external client IP address appear to be internal. The ssh ( secure shell , www.ssh.net) package supports a port-redirection feature to forward data from a local client port to a designated server port. Another approach is that of PPTP (Point-to-Point Tunneling Protocol), a protocol with strong Microsoft ties; see www.microsoft.com.