Dnscrypt vs Dnscurve?

Question

Which is better for highest privacy and security ? I've read both of them and i still don't understand the differences between them...

Can anyone explain what features is exclusive to one? My most concern is privacy and security.

See http://dnscrypt.org/ and http://dnscurve.org/

Answer 1

With DNSSEC and DNSCurve, one can verify that a DNS response contains what the zone owner configured the authoritative servers to serve. The registrar and the parent zone owner can also produce valid DNSSEC signatures. But no one else can.

In a perfect world, everything would be signed with DNSSEC or DNSCurve, and everybody would run a validating resolver on each device, providing almost end-to-end security.

Unfortunately, this is not the case.

A usual scenario is that the local router has a built-in caching resolver, and all the devices connected to it just use that.

However, the local network is usually the network segment which is the most vulnerable to DNS spoofing. So, it's nice to have DNSSEC/DNSCurve verification on the router, but it doesn't prevent injection of fake DNS responses by someone on the same network as you. This is where DNSCrypt can help.

DNSCrypt is typically deployed using a pair of DNS proxies: a client proxy and a server proxy. The client side of DNSCrypt is a proxy to which regular DNS clients can connect to. It translates regular DNS queries into authenticated DNS queries, forwards them to a server running the server DNSCrypt proxy, verifies the responses, and forwards them to the client if they appear to be genuine. The server side of DNSCrypt receives DNS queries sent by the client proxy, forwards them to a trusted DNS resolver, and signs the responses it receives before forwarding them to the client proxy.

The DNSCrypt server can run on the router, along with a modern DNS resolver. Clients can then run the client code of DNSCrypt, leveraging the router DNS resolver.

    |----- Most vulnerable to attacks ------|            |-- Most vulnerable to censorship --|

         dnscrypt client               dnscrypt server
Laptop/workstation/phone/tablet --------> home router --------> ISP --------> the Internet

    |--------- Secured by DNSCrypt ---------| |------------- Secured by DNSSEC --------------|

Alternatively, companies, organizations and individuals are running public DNS resolvers supporting the DNSCrypt protocol. These can be used as an alternative to running a DNSCrypt server and a DNS resolver on the router. If your ISP is doing DNS-based censorship, this is a way to bypass it (but in that case keep in mind that the 3rd-party DNS resolver you use can still log all your queries).

All you need to use them is a DNSCrypt client such as dnscrypt-proxy or Pcap_DNSProxy. This will make sure that responses you received are the same as what the 3rd party DNS resolver you are using initially sent. However, these responses might not be the correct ones. It's just what these services decided to send to you, not necessarily what the owner of the zone you are querying published.

Some VPN services run their own DNS resolvers, accessible over DNSCrypt, in order to mitigate DNS "leaks". Since you already trust them for tunneling all your traffic, it cannot hurt.

The DNSCrypt client can run on every client device:

    |----- Most vulnerable to attacks ------|            |-- Most vulnerable to censorship --|

         dnscrypt client                                                                                 dnscrypt server
Laptop/workstation/phone/tablet --------> home router --------> ISP ----------> the Internet --------> public DNS resolver

    |----------------------------------- Secured by DNSCrypt -------------------------------------------|
                                                                              |--- Secured by DNSSEC ---|
                                                                     |--- Most vulnerable to logging ---|

Or if you totally trust the local network, the DNSCrypt client can run on the router instead:

    |----- Most vulnerable to attacks ------|            |-- Most vulnerable to censorship --|

                                        dnscrypt client                                                  dnscrypt server
Laptop/workstation/phone/tablet --------> home router --------> ISP ----------> the Internet -------->  public DNS resolver

                                            |------------------ Secured by DNSCrypt --------------------|
                                                                              |--- Secured by DNSSEC ---|
                                                                     |--- Most vulnerable to logging ---|

Finally, you can run your own DNSCrypt server on a remote, trusted network, to get the best possible protection against censorship, while having full control over what the resolver is logging:

    |----- Most vulnerable to attacks ------|            |-- Most vulnerable to censorship --|

        dnscrypt client                                                                                 dnscrypt server
Laptop/workstation/phone/tablet --------> home router --------> ISP ----------> the Internet --------> private DNS resolver

    |----------------------------------- Secured by DNSCrypt -------------------------------------------|
                                                                              |--- Secured by DNSSEC ---|

So, which one do you need?

They are complementary, and address different things.

If you are running your own caching resolvers, having them support DNSSEC and DNSCurve validation is an excellent thing. Unfortunately, as of today, the number of domains signed with DNSCurve is close to zero, and the number of DNSSEC-signed zones is growing pretty slowly.

For all the zones that aren't signed, DNSCrypt cannot protect everything, but it will at least protect the few hops between your client devices and the DNS resolver, which is better than nothing. It also runs on a different port than regular DNS traffic (443 instead of 53), which is enough to bypass some content filters.

But if your primary concern is privacy, what you need is a VPN.

Answer 2

DNSCrypt is based on DNSCurve in part, but they serve different purposes.

DNSCrypt encrypts traffic between stub resolvers (your workstation, your browser, etc.) and recursors (like your ISP offers, and like OpenDNS). It gives you confidentiality and integrity between your workstation and the resolving service.

DNSCurve sits in another place - between recursors (like OpenDNS) and authoritatives (like ns1.google.com, like the DNS your webhoster runs for you). It provides confidentiality and integrity on that leg of the journey.