On Fri, 31 May 2013, Ken A wrote:
What is keeping nameserver vendors from building this into servers?
Sanity..... Whoever designs a security protocol with no crypto algility should take up another hobby, something nice like gardening or star gazing. On top of that, there is the question of usefulness. You send out an encrypted DNS packet for www.secret.com. No one knows what you looked up, just that you asked "some dns question". Next, they observe you sending http/https traffic to IP address 1.2.3.4. Even if we assume these present no cryptographic plaintext attacks for the remainder of your crypto-dns session, there is really no need to break it. I already know what you did. There are going to be what, upto 1000 vhosts on that IP address (but more likely 1 if you used TLS) If you want remain anonymous, you should fire your DNS over a secure connection into the TOR network (using dns over TCP), and then use your TOR network for the http/https connection as well. Using today's DNS standards and software implementations this is already possible. Paul _______________________________________________ dns-operations mailing list [email protected] https://lists.dns-oarc.net/mailman/listinfo/dns-operations dns-jobs mailing list https://lists.dns-oarc.net/mailman/listinfo/dns-jobs
