Blog proposal (2026): encrypted DNS still has a recognizable shape

[williamzujkowski]

Question and 2026 source

Encrypted DNS still has a recognizable shape. Which visible fields identify DNS traffic after encryption, and what do mitigations cost?

Lenders, Schmidt and Wählisch, Secrets Best Not Shared: DNS Privacy Enhancements for the Constrained IoT, first arXiv submission June 8, 2026, v1 full text; peer-reviewed IEEE EuroS&P 2026, DOI 10.1109/EuroSP68448.2026.00094. An artifact was already public in April 2026. Reviewed September 11, 2026, especially §§III, V–VI and VIII.

The study classifies DNS versus application-data frames, not decrypted domain names. Its DoH comparison uses HTTP/2 and TLS 1.2 PSK for aligned experimental stacks; avoid generalizing to all modern DoH traffic.

This differs from #592's shared-cache question and the DoH deployment post: the subject is visible packet metadata. Coordinate with privacy correction #593.

Proposed bounded analysis, not yet run

The versioned artifact offers a 171.2-MB code/plot-data package separately from its 175.4-GB full dataset. Begin with one published figure and one scenario's header-feature analysis. If a small raw subset is available, compare address-only, length-only and combined features with majority/permuted-label controls and held-out deployments.

Proposed cap: one day, 8-GB RAM, 2-GB downloads, CPU-only. If raw data is unavailable within the cap, publish a clearly labeled analysis of aggregate results, with no new classifier-performance claim. No live traffic collection. Inspect and pin code/license before use; do not run an upstream setup script during discovery.

• Preserve the distinction between traffic classification and content recovery.
• Verify denominators, deployment split and protocol/version limitations.
• Retain reproduced figure inputs and negative/non-reproduction outcomes.
• Complete source, security/NDA, overlap, voice and visual reviews.

[williamzujkowski]

Backlog grooming (2026-09-12): later research proposal. Coordinate with #593 first so the existing DoH article does not retain the privacy overclaim while a follow-up is developed.

[williamzujkowski]

Proposal review — 2026-09-13

Review decision: priority 6 — reframe to constrained IoT and defer standalone publication. The present broad encrypted-DNS framing is too loose. Section VIII-A of the cited paper explicitly discourages isolated DoH studies with this dataset; its aligned TLS 1.2 setup and frame-classification task cannot establish general modern-DoH or domain-recovery claims. The corrected DoH article already covers residual traffic-analysis limits.

A credible replacement asks what encrypted IoT packet headers still reveal and which header-elision choice changes that. Before proceeding, identify one named scenario, a figure-to-input mapping and a concrete IoT reader decision. Small plot CSVs are available; new classifier claims still need an appropriate raw subset/evaluation split within budget. The full upstream workflow is much larger and was not executed.

Supersedes the automatic aggregate-analysis fallback: exceeding the raw-data budget does not itself justify publishing a recap. If the reader decision or usable evidence is absent, retain notes and shelve the standalone article. Primary limitation: https://arxiv.org/html/2606.10097v1#S8

Full evidence and ranked portfolio: https://github.com/williamzujkowski/williamzujkowski.github.io/blob/main/docs/research/2026-09-13-proposal-review.md

This records editorial priority and evidence gates, not completed experiments or publication approval. Existing scheduled posts are unchanged.