DNSCrypt
Internet security protocols |
---|
Key management |
|
Application layer |
Domain Name System |
Internet Layer |
DNSCrypt is a
It also mitigates UDP-based amplification attacks by requiring a question to be at least as large as the corresponding response. Thus, DNSCrypt helps to prevent DNS amplification attacks.[2]: §9
DNSCrypt was originally designed by Frank Denis and Yecheng Fu. Multiple free and open source software implementations exist. It is available for a variety of operating systems, including Unix, Apple iOS, Linux, Android, and Microsoft Windows.
Deployment
In addition to private deployments, the DNSCrypt protocol has been adopted by several public DNS resolvers, the vast majority being members of the OpenNIC network, as well as virtual private network (VPN) services.
OpenDNS (now a part of Cisco) announced the first public DNS service supporting DNSCrypt on 6 December 2011, shortly followed by CloudNS Australia.[6]
On 29 March 2016, Yandex announced support for the DNSCrypt protocol on their public DNS servers, as well as in Yandex Browser.[citation needed]
On 14 October 2016, AdGuard added DNSCrypt to their DNS filtering module so that users could move from their ISPs to custom or AdGuard's own DNS servers for online privacy and ad blocking.[7][8]
On 10 September 2018, the Quad9 nonprofit public recursive resolver service announced support for DNSCrypt.[9]
Other servers that support secure protocol are mentioned in the DNSCrypt creators' list.[10]
Protocol
DNSCrypt can be used either over
Instead of relying on trusted
The DNSCrypt protocol can also be used for access control or accounting, by accepting only a predefined set of public keys. This can be used by commercial DNS services to identify customers without having to rely on IP addresses.[2]: §13
Queries and responses are encrypted using the same algorithm and padded to a multiple of 64 bytes in order to avoid leaking packet sizes. Over UDP, when a response would be larger than the question leading to it, a server can respond with a short packet whose TC (truncated) bit has been set. The client should then retry using TCP and increase the padding of subsequent queries.[2]: §9
Versions 1 and 2 of the protocol use the
As of 2023, there are no known vulnerabilities in the DNSCrypt protocol nor practical attacks against its underlying cryptographic constructions.
Anonymized DNSCrypt
Anonymized DNSCrypt is a protocol extension proposed in 2019 to further improve DNS privacy.[11]
Instead of directly responding to clients, a resolver can act as a transparent proxy to another resolver, hiding the real client IP to the latter. Anonymized DNSCrypt, specifically designed for DNS traffic, is a lightweight alternative to running DNSCrypt through Tor and SOCKS proxies.[11]
Deployment of Anonymized DNSCrypt started in October 2019, and the protocol adoption was fast, with 40 DNS relays being set up only two weeks after the public availability of client and server implementations.[12]
See also
- DNS over HTTPS
- DNS over TLS
- Domain Name System Security Extensions (DNSSEC)
- Elliptic curve cryptography
- Curve25519
- DNSCurve
References
- ^ Biggs, John (6 December 2011). "DNSCrypt Encrypts Your DNS Traffic Because There's Always Someone Out To Get You". TechCrunch.
- ^ a b c d e f g "DNSCrypt version 2 protocol specification (DNSCRYPT-V2-PROTOCOL.txt)". GitHub/DNSCrypt.
(UDP) The response length should always be equal to or shorter than the initial client query length.
- ^ "DNSCrypt - Implementations". dnscrypt.info.
- ^ "DNSCrypt/dnscrypt-proxy: dnscrypt-proxy 2 - A flexible DNS proxy, with support for encrypted DNS protocols". GitHub. DNSCrypt. Archived from the original on 20 January 2016. Retrieved 29 January 2016.
- ^ "Oblivious DoH · DNSCrypt/dnscrypt-proxy Wiki". GitHub. DNSCrypt project. Retrieved 28 July 2022.
- ^ Ulevitch, David (6 December 2011). "DNSCrypt – Critical, fundamental, and about time". Cisco Umbrella. Archived from the original on 1 July 2020. Retrieved 1 July 2020.
- ^ "AdGuard DNS Now Supports DNSCrypt". AdGuard Blog. Archived from the original on 12 September 2017. Retrieved 11 September 2017.
- ^ "DNS filtering". AdGuard Knowledgebase. Archived from the original on 11 September 2017. Retrieved 11 September 2017.
- ^ "DNSCrypt Now in Testing". Quad9 Blog. 30 August 2018. Archived from the original on 28 December 2019. Retrieved 1 July 2020.
- ^ "DNSCrypt - List of public DoH and DNSCrypt servers". DNSCrypt. Archived from the original on 19 June 2020. Retrieved 1 July 2020.
- ^ a b "Anonymized DNSCrypt specification". GitHub. DNSCrypt. Archived from the original on 25 October 2019. Retrieved 1 July 2020.
- ^ "Anonymized DNS relays". GitHub. DNSCrypt. 1 November 2019. Archived from the original on 1 July 2020. Retrieved 1 July 2020.