FTExfil: DNS Tunneling via Format Transforming Encryption and Huffman Coding

Abstract

FTExfil is a proof-of-concept DNS tunneling tool for file transfer using Format Transforming Encryption (FTE) and character frequency shaping through a novel application of Huffman coding. The goal is to reduce payload-level indicators commonly associated with DNS tunneling, particularly high hostname entropy and recognizable Base32/Base64 encodings.

The tool encrypts and authenticates file chunks, encodes them into DNS query names, and reconstructs the original file at an authoritative server. Evaluation on a 1 MiB test file shows that regex-based FTE provides higher throughput and fewer DNS packets than weighted Huffman encoding, with measured hostname entropy of approximately 4.674 bits per character. Weighted encoding reduces entropy to approximately 4.180 bits per character but requires more packets and longer transfers. Base32 provides the highest throughput among the three evaluated encodings.

The results demonstrate a trade-off between shaping the visible representation and transmission overhead. Entropy and character frequency shaping can reduce certain payload-level indicators, while traffic-level indicators such as query volume remain unresolved.

Introduction

Covert communication aims to conceal not only the contents of a message, but also the fact that communication is taking place. Encryption provides confidentiality, whereas a covert channel concerns the observable form or behaviour of the exchange. In computer networks, information can be hidden in protocol fields, packet timing, or messages that appear to perform an ordinary task.

DNS is a particularly useful example. A client normally queries a name to obtain resource records, often an IP address. However, when a sender places encoded data in a query name under a controlled domain, normal DNS resolution can deliver that information to the domain’s authoritative nameserver. A recursive resolver may therefore carry data between the sender and receiver without acting as a conventional application-data relay.

Common tunneling encodings represent encrypted bytes using Base32 or Base64. Their efficiency comes with recognizable characteristics: long labels, relatively uniform character distributions, and high per-character entropy. Detection methods can use these properties alongside broader traffic patterns to identify suspicious activity.

Research question

Can encrypted DNS tunnel payloads be made less suspicious without making the tunnel impractically inefficient?

There are two competing goals. Restricting messages to familiar names or a small dictionary can make the output more realistic, but offers little capacity for arbitrary data. Conventional binary-to-text encodings provide much greater capacity, but their random-looking labels are easier to distinguish from ordinary hostnames.

FTExfil investigates a middle ground through two approaches:

1. Format Transforming Encryption constrains encrypted output to a regular-expression-defined language.
2. Weighted Huffman encoding transforms uniformly distributed encrypted bits into letters whose frequencies approximate a target distribution.

The first approach changes the permitted format and alphabet. The second changes the distribution within the alphabet. Both influence how many encrypted bits can be represented by a DNS query name.

Contribution and scope

The implementation is a Rust command-line application supporting client and server modes, chunking and reassembly, encrypted and authenticated payloads, configurable encodings, and optional ECDH key exchange using X25519 or P-256.

The FTE layer is a native Rust reimplementation of existing libfte functionality. The experimental contribution is the use of Huffman coding in the reverse direction of ordinary compression to shape the characters emitted from an encrypted bitstream.

The project concentrates on one-directional file transfer and payload-level characteristics. It does not implement a general-purpose IP tunnel, and it does not eliminate traffic-level indicators. Evaluation against actual DNS tunneling detection systems is left for future work.

Academic context

This bachelor project was completed in Software Engineering at the University of Southern Denmark in June 2026, under the supervision of Professor Lars Ramkilde Knudsen.

The work is intended solely for academic research into DNS tunneling, its limitations, and its security implications. The author does not condone unauthorized access, data exfiltration, or unlawful activity.