Re:DNS cache poisoning, the Internet attack from 2008, is ba...
by arminiusreturns on Thursday November 12, 2020 @01:33PM
(#25073060)
I haven't been keeping up, do you know if DNSCURVE also prevents this attack? I remember digging into it a bit a while back (~2015) and coming away thinking I liked DNSCURVE a lot better, but that in the end I expected both to be used in conjuction in the future.
Re:DNS cache poisoning, the Internet attack from 2008, is ba...
by tptacek on Thursday November 12, 2020 @02:19PM
(#25073728)
DNSCURVE is a dead letter, due to DoT and DoH, but all 3 address this attack the same way: a transaction between two speakers of these protocols can't be cache-poisoned directly (but a transaction between your DoH-speaking cache and a non-DoH speaker can in theory be cache-poisoned, and the point of poisoning the cache is that your subsequent lookups will get the faulty data).
DNSCURVE was explicit about the idea of doing bottom-up protection of the whole DNS, so that servers would use it with other servers. You can, of course, do that with DoH as well, but it's not an "indicated use" yet.
So the short answer is: DoH & friends break this attack completely against home router forwarders (the first target in the paper), but not for major public resolvers like 8.8.8.8; they'll need to take some steps to break it themselves.
Nobody is debating whether DNSSEC addresses this attack --- it does, for server-to-server connections. But DNSSEC is an extremely expensive way to stop this attack, and because there are cheaper ways that don't require collaboration between unrelated parties on the Internet, those are the mitigations --- ICMP policy changes, 0x20 encoding, DNS cookies, etc --- that will happen.