Researchers have identified that encrypted DNS traffic remains vulnerable to eavesdropping due to exposed plaintext headers, prompting a new proposal to use header elision to improve network privacy.

Key Points

• Encrypted DNS protocols like DoT and DoH protect query contents but leave plaintext headers, such as IP addresses and TCP sequence numbers, visible to network observers.
• A study of 58,768 request-response pairs revealed that monotonic counters and specific header fields allow attackers to identify and profile DNS traffic patterns.
• Researchers proposed using Static Context Header Compression (SCHC) and block-wise transfer to obscure packet lengths and remove identifiable header fields.
• Implementing these defenses reduced classifier accuracy for identifying DNS flows to between 77 and 86 percent, significantly increasing the difficulty of traffic analysis.
• The team recommends using protocols like QUIC, OSCORE, and Oblivious DNS, alongside timing obfuscation, to further protect traffic in non-IoT environments.

Why it Matters

This research highlights a critical privacy gap where metadata leaks undermine the security benefits of encrypted DNS, particularly for Internet of Things devices. By demonstrating how header information can be used to profile user activity, the study provides a roadmap for developers to harden network protocols against sophisticated traffic analysis attacks.