DNSCrypt

DNSCrypt is a network protocol that authenticates and encrypts Domain Name System (DNS) traffic between the user's computer and recursive name servers. It was originally designed by Frank Denis and Yecheng Fu.

Although multiple free and open source software implementations exist, the protocol was never proposed to the Internet Engineering Task Force (IETF) by the way of a Request for Comments (RFC). It is available for a variety of operating systems, including Unix, Apple iOS, Linux, Android, and Microsoft Windows.

DNSCrypt wraps unmodified DNS traffic between a client and a DNS resolver in a cryptographic construction in order to detect forgery. Though it doesn't provide end-to-end security, it protects the local network against man-in-the-middle attacks. The free and open source software implementation dnscrypt-proxy additionally integrates ODoH.

It also mitigates UDP-based amplification attacks by requiring a question to be at least as large as the corresponding response. Thus, DNSCrypt helps to prevent DNS amplification attacks.

Deployment

In addition to private deployments, the DNSCrypt protocol has been adopted by several public DNS resolvers, the vast majority being members of the OpenNIC network, as well as virtual private network (VPN) services.

OpenDNS (now a part of Cisco) announced the first public DNS service supporting DNSCrypt on 6 December 2011, shortly followed by CloudNS Australia.

On 29 March 2016, Yandex announced support for the DNSCrypt protocol on their public DNS servers, as well as in Yandex Browser.

On 14 October 2016, AdGuard added DNSCrypt to their DNS filtering module so that users could move from their ISPs to custom or AdGuard's own DNS servers for online privacy and ad blocking.

On 10 September 2018, the Quad9 nonprofit public recursive resolver service announced support for DNSCrypt.

Other servers that support secure protocol are mentioned in the DNSCrypt creators’ list.

Protocol

DNSCrypt can be used either over UDP or over TCP. In both cases, its default port is 443. Even though the protocol radically differs from HTTPS, both service types utilize the same port. However, even though DNS over HTTPS and DNSCrypt are possible on the same port, they must still run separately on different servers. Two server applications cannot run simultaneously on the same server if both utilize the same port for communication; though a multiplexing approach is theoretically possible.

Instead of relying on trusted certificate authorities commonly found in web browsers, the client has to explicitly trust the public signing key of the chosen provider. This public key is used to verify a set of certificates, retrieved using conventional DNS queries. These certificates contain short-term public keys used for key exchange, as well as an identifier of the cipher suite to use. Clients are encouraged to generate a new key for every query, while servers are encouraged to rotate short-term key pairs every 24 hours.

The DNSCrypt protocol can also be used for access control or accounting, by accepting only a predefined set of public keys. This can be used by commercial DNS services to identify customers without having to rely on IP addresses.

Queries and responses are encrypted using the same algorithm and padded to a multiple of 64 bytes in order to avoid leaking packet sizes. Over UDP, when a response would be larger than the question leading to it, a server can respond with a short packet whose TC (truncated) bit has been set. The client should then retry using TCP and increase the padding of subsequent queries.

Versions 1 and 2 of the protocol use the X25519 algorithm for key exchange, EdDSA for signatures, as well as XSalsa20-Poly1305 or XChaCha20-Poly1305 for authenticated encryption.

As of 2020, there are no known vulnerabilities in the DNSCrypt protocol nor practical attacks against its underlying cryptographic constructions.

Anonymized DNSCrypt

Anonymized DNSCrypt is a protocol extension proposed in 2019 to further improve DNS privacy.

Instead of directly responding to clients, a resolver can act as a transparent proxy to another resolver, hiding the real client IP to the latter. Anonymized DNSCrypt is a lightweight alternative to Tor and SOCKS proxies, specifically designed for DNS traffic.

Deployment of Anonymized DNSCrypt started in October 2019, and the protocol adoption was fast, with 40 DNS relays being set up only two weeks after the public availability of client and server implementations.

See also

* DNS over HTTPS
* DNS over TLS
* Domain Name System Security Extensions (DNSSEC)
* Elliptic curve cryptography
* Curve25519
* DNSCurve

References

External links

*

DNSCrypt protocol specification

{{Internet censorship circumvention technologies

Domain Name System
Internet protocols