Post

Center for Democracy & Technology
@cdt.org

NEW BLOG: From CDT’s Nick Doty, “Distributing the Keys for Private Access to the Web.” Every lock needs a key – but encrypted DNS and Encrypted Client Hello (ECH) only work if users can obtain the configurations that enable them.

cdt.orgDistributing the Keys for Private Access to the WebBreaking the DNS Dependencych-22" class="toc-anchor">ECH’s Catch-22thing-strange-in-the-dns" href="#something-strange-in-the-dns" class="toc-anchor">Something Strange in the DNS use it. That’s the fundamental challenge facing encrypted DNS and Encrypted Client Hello (ECH). These protocols can protect your browsing from prying eyes, but only if you can first obtain the cryptographic configurations that make them work. In places like China, censors have […]

3 reposts6 likes

Center for Democracy & Technology
@cdt.org

In practice, censors don’t need to break encryption. As China’s Great Firewall shows, blocking or degrading DNS-based key delivery can stop these protections before they start.

cdt.orgDistributing the Keys for Private Access to the WebBreaking the DNS Dependencych-22" class="toc-anchor">ECH’s Catch-22thing-strange-in-the-dns" href="#something-strange-in-the-dns" class="toc-anchor">Something Strange in the DNS use it. That’s the fundamental challenge facing encrypted DNS and Encrypted Client Hello (ECH). These protocols can protect your browsing from prying eyes, but only if you can first obtain the cryptographic configurations that make them work. In places like China, censors have […]
Center for Democracy & Technology
@cdt.org

ECH is designed to prevent hostname-based censorship, but it depends on DNS to fetch its key. That creates a critical vulnerability. If DNS is controlled, ECH fails by default. A next step for privacy: more resilient ways to distribute and authenticate keys beyond DNS.

cdt.orgDistributing the Keys for Private Access to the WebBreaking the DNS Dependencych-22" class="toc-anchor">ECH’s Catch-22thing-strange-in-the-dns" href="#something-strange-in-the-dns" class="toc-anchor">Something Strange in the DNS use it. That’s the fundamental challenge facing encrypted DNS and Encrypted Client Hello (ECH). These protocols can protect your browsing from prying eyes, but only if you can first obtain the cryptographic configurations that make them work. In places like China, censors have […]