3 ms·
DNSCrypt / DNSCurve will be great for security of DNS and the internet in general. I hope this helps it reaches wide deployment. For background, it is the fir
by onedognight 15y ago
DNSCrypt / DNSCurve will be great for security of DNS and the internet in general. I hope this helps it reaches wide deployment.
For background, it is the first implementation of DNSCurve designed by DJB (qmail, tinydns, daemontools, etc). See http://dnscurve.org/ http://dnscurve.org/ or the excerpt below.
DNSCurve uses high-speed high-security elliptic-curve cryptography to drastically improve every dimension of DNS security:
Confidentiality: DNS requests and responses today are completely unencrypted and are broadcast to any attacker who cares to look. DNSCurve encrypts all DNS packets.
Integrity: DNS today uses "UDP source-port randomization" and "TXID randomization" to create some speed bumps for blind attackers, but patient attackers and sniffing attackers can easily forge DNS records. DNSCurve cryptographically authenticates all DNS responses, eliminating forged DNS packets.
Availability: DNS today has no protection against denial of service. A sniffing attacker can disable all of your DNS lookups by sending just a few forged packets per second. DNSCurve very quickly recognizes and discards forged packets, so attackers have much more trouble preventing DNS data from getting through. Protection is also needed for SMTP, HTTP, HTTPS, etc., but protecting DNS is the first step.
Despite its extremely high level of security, DNSCurve is very easy for software authors to implement, and very easy for administrators to deploy.
DNSCurve is part of a larger project to encrypt and authenticate all Internet packets. The techniques used in DNSCurve are easily adapted to other Internet protocols.
- pjscott 15y agoA summary of the summary is that it encrypts and authenticates all communication with DNS servers that support the protocol, and does so with very little overhead, in a way that can be rolled out incrementally.
- zdw 15y agoA comparative clarity enhancing corollary to the summary of the summary: DNSCurve is like ssh - no central authority, secures and hides the contents of the connection, not the data at rest. Server keys are published as part of the NS record of the domain. DNSSEC is like PGP with SSL's centralize certificate authorities - trusted parties use keys to sign zone files which can be stored on an untrusted server but still authenticated. No encryption on server-client communication. They're really complimentary techniques with different goals and means of achieving them.
- aidenn0 15y agoDoes DNSCurve offer any protection against a MITM attack (e.g. open wifi with dns hijacking)
- zdw 15y agoDepends on the client implementation. If your client machine's resolver is set to use DNSCurve enabled recursive servers and has know good copies of their keys and IP addresses, then trying to MITM would require breaking the encryption (ie, impossible/very unlikely). That said, if you have control at the registrar level or an intermediary or above the recursive nameserver, you could change the NS records to use your keys and MITM it that way.
- alwillis 15y agoReally good stuff—just installed the Mac version. Really impressed how easy it was to install and configure. No more Google DNS.