3 ms·
As covered in TFA, DNSCurve provides encryption between a DNS resolver and the client. It doesn't allow domain owners to sign their records. Dan Kaminsky did
by indolering 11y ago
As covered in TFA, DNSCurve provides encryption between a DNS resolver and the client. It doesn't allow domain owners to sign their records.
Dan Kaminsky did a good job taking DNSCurve apart back in 2011: http://dankaminsky.com/2011/01/05/djb-ccc/ http://dankaminsky.com/2011/01/05/djb-ccc/
"I observe this is essentially a walk of Zooko’s Triangle, and does not represent an effective or credible solution to what we’ve learned is the hardest problem at the intersection of security and cryptography: Key Management. I conclude by pointing out that DNSSEC does indeed contain a coherent, viable approach to key management across organizational boundaries, while this talk — alas — does not."
- cbsmith 11y ago"If you are willing to embrace the pitfalls and advantages of such an approach, you don't need DNSSEC." That was in reference to Zooko's Triangle. You have to choose one of the other two if you are doing decentralized. The obvious choice being that you can't trust the human readable host names.
- indolering 11y agocbsmith: I'm not sure what you mean ... using a traditional TLD means that you made the choice to add third party trust to your system. Adding the CA system just adds additional third parties that you have to trust.