On the Feasibility of a Censorship Resistant Decentralized Name System

Abstract

Abstract. A central problem on the Internet today is that key infrastructure for security is concentrated in a few places. This is particularly true in the areas of naming and public key infrastructure. Secret services and other government organizations can use this fact to block access to information or monitor communications. One of the most popular and easy to perform techniques is to make information on the Web inaccessible by censoring or manipulating the Domain Name System (DNS). With the introduction of DNSSEC, the DNS is furthermore posed to become an alternative PKI to the failing X.509 CA system, further cementing the power of those in charge of operating DNS. This paper maps the design space and gives design requirements for censorship resistant name systems. We survey the existing range of ideas for the realization of such a system and discuss the challenges these systems have to overcome in practice. Finally, we present the results from a survey on browser usage, which supports the idea that delegation should be a key ingredient in any censorship resistant name system.

ZKlaims: Privacy-preserving Attribute-based Credentials using Non-interactive Zero-knowledge Techniques

“…An alternative to NameID is re-claimID (Schanzenbach et al, 2018), which uses the decentralized GNU Name System (GNS) (Wachs et al, 2014a;Wachs et al, 2014b). reclaimID allows users to be completely sovereign over their own identities and selectively authorize access to identity attributes using attribute-based encryption (ABE).…”

FilteredWeb: A framework for the automated search-based discovery of blocked URLs

“…By manipulating the DNS, a censor can restrict access to sensitive content in an effective and scalable manner. Simply put, DNS queries for blacklisted sites can generate a range of responses [5]: an error, an incorrect IP address or an IP address to a non-existent server.…”

DP5: A Private Presence Service

“…The GNU Name System [41] and a proposal by Tan and Sherr [40] use a Distributed Hash Table (DHT) maintained by users to mirror all peers' name records and mappings rendezvous points. DHTs, however, do not provide strong privacy protections; extensions that add anonymity to DHTs [3,42] generally rely on strong assumptions such as the absence of Sybil attacks [26] and provide only loose probabilistic guarantees for a single query, and unknown protection against longterm traffic analysis.…”