3 ms·
I haven't been keeping up, do you know if DNSCURVE also prevents this attack? I remember digging into it a bit a while back (~2015) and coming away thinking I l
by arminiusreturns 6y ago
I haven't been keeping up, do you know if DNSCURVE also prevents this attack? I remember digging into it a bit a while back (~2015) and coming away thinking I liked DNSCURVE a lot better, but that in the end I expected both to be used in conjuction in the future.
- tptacek 6y agoDNSCURVE is a dead letter, due to DoT and DoH, but all 3 address this attack the same way: a transaction between two speakers of these protocols can't be cache-poisoned directly (but a transaction between your DoH-speaking cache and a non-DoH speaker can in theory be cache-poisoned, and the point of poisoning the cache is that your subsequent lookups will get the faulty data). DNSCURVE was explicit about the idea of doing bottom-up protection of the whole DNS, so that servers would use it with other servers. You can, of course, do that with DoH as well, but it's not an "indicated use" yet. So the short answer is: DoH & friends break this attack completely against home router forwarders (the first target in the paper), but not for major public resolvers like 8.8.8.8; they'll need to take some steps to break it themselves.