<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><blockquote type="cite"><div dir="ltr"><div class="gmail_extra"><br></div><div class="gmail_extra"><div class="gmail_default" style="font-family:tahoma,sans-serif">Which brings me to the topic of resolver-behind-upstream attacks which were not commented upon.</div>
<div class="gmail_default" style="font-family:tahoma,sans-serif">As you know, one of the recommendations of experts and Internet operators, following Kaminsky attack, was `either deploy patches or configure your resolver to use a secure upstream forwarder`, e.g., OpenDNS was typically recommended. The security is established since the resolver is hidden from the Internet and sends its requests only via its upstream forwarder.</div>
<div class="gmail_default" style="font-family:tahoma,sans-serif">This configuration is still believed to be secure and is recommended by experts.</div></div></div></blockquote><div><br></div>Would DNSCrypt, supported by OpenDNS, be a possible mitigation to this issue ? <br><blockquote type="cite"><div dir="ltr"><div class="gmail_extra"><div class="gmail_default" style="font-family:tahoma,sans-serif"><br>
</div>
<div class="gmail_default" style="font-family:tahoma,sans-serif">As you know we found vulnerabilities in such configuration, and designed techniques allowing to find the IP address of the hidden resolver, and then to discover its port allocation (the attacks apply to per-destination ports recommended in [RFC6056] or to fixed ports).</div>
<div class="gmail_default" style="font-family:tahoma,sans-serif">This attack can be extremely stealthy and efficient, and applies to networks where communication between the resolver and upstream forwarder is not over TCP, and therefore can be fragmented (fragmentation of a single byte suffices).</div></div></div></blockquote><br></div><div>Would IPSEC between resolver and upstream forward be a possible mitigation to this issue ? </div><div><br></div><div><br></div><div>Rubens</div><div><br></div></body></html>