Padding Ain't Enough: Assessing the Privacy Guarantees of Encrypted DNS
summary
The paper evaluates privacy of DNS over TLS (DoT) and DNS over HTTPS (DoH) and shows that RFC 8467-style message padding is not enough to prevent traffic-analysis. It introduces a traffic-analysis technique that combines packet size and inter-arrival timing and models multi-query DNS Sequences to fingerprint websites; in a closed-world test on the Tranco top-10k, attackers could deanonymize 86.1% of sites and perfectly label 65.9%. The authors conclude that defenses must eliminate timing entropy between query responses, not just pad message sizes.
AI-written summary · about
chapters (6)
- 0:00Encrypted DNS privacy concerns
- 1:58DNS message patterns and timing
- 3:47Fingerprinting DNS sequences
- 6:07Classifying websites via DNS
- 8:17Mitigating timing attacks
- 10:05Performance vs privacy
related talks
26mMisuse of DNS, the Second Most Used Protocol
46mPanel: DNS Privacy Vs.
25mProtective DNS, DNS Encryption, & Zero-Trust: Tackling NSA Guidance
19mBuilding Privacy Into the Internet
01h 27mDNS at 30
25mDark Side of the DNS Force
15mYou Depend on DNS, This Is How It Works and You Won't...
13mA Positive Security Talk