3 ms·
> With a DNSSEC signed root anyone can host their own copy of the root zone, and we can all cryptographically verify that it is the same root. If that's the be
by Panino 10y ago
> With a DNSSEC signed root anyone can host their own copy of the root zone, and we can all cryptographically verify that it is the same root.
If that's the best counterpoint, then I'm sorry to say that this has already been possible for a long time. I remember it being available at least 10 or 15 years ago.
https://www.internic.net/domain/ https://www.internic.net/domain/
At the above link you can download, over HTTPS, the root zone including PGP signatures.
With everything taken into account, DNSSEC causes far more problems than it solves.
- AndyMcConachie 10y agoThe root zone has always been publicly available. But isn't it nice that you can cryptographically verify that this is the root-zone with DNSSEC? I'm not sure how you're verifying it using PGP, but I think you mean public key encryption, which is what DNSSEC is using.
- tptacek 10y agoDNSSEC does not in fact use public-key encryption; it uses public-key signatures, with an outmoded RSA construction that would have been rejected for new protocols 5 years ago. In fact: TLS 1.3 just jettisoned RSA.