3 ms·
A summary of the summary is that it encrypts and authenticates all communication with DNS servers that support the protocol, and does so with very little overhe
by pjscott 15y ago
A summary of the summary is that it encrypts and authenticates all communication with DNS servers that support the protocol, and does so with very little overhead, in a way that can be rolled out incrementally.
- zdw 15y agoA comparative clarity enhancing corollary to the summary of the summary: DNSCurve is like ssh - no central authority, secures and hides the contents of the connection, not the data at rest. Server keys are published as part of the NS record of the domain. DNSSEC is like PGP with SSL's centralize certificate authorities - trusted parties use keys to sign zone files which can be stored on an untrusted server but still authenticated. No encryption on server-client communication. They're really complimentary techniques with different goals and means of achieving them.
- aidenn0 15y agoDoes DNSCurve offer any protection against a MITM attack (e.g. open wifi with dns hijacking)
- zdw 15y agoDepends on the client implementation. If your client machine's resolver is set to use DNSCurve enabled recursive servers and has know good copies of their keys and IP addresses, then trying to MITM would require breaking the encryption (ie, impossible/very unlikely). That said, if you have control at the registrar level or an intermediary or above the recursive nameserver, you could change the NS records to use your keys and MITM it that way.