2 ms·
> DNSSEC And NTP, which is basically a dependency for DNSSEC due to validity intervals too; From https://news.ycombinator.com/item?id=47270665 https://news.y
by westurner 7mo ago
> DNSSEC
And NTP, which is basically a dependency for DNSSEC due to validity intervals too;
From
https://news.ycombinator.com/item?id=47270665 https://news.ycombinator.com/item?id=47270665 :
> By assigning Decentralized Identifiers (like did:tdw or SSH-key DIDs) to individual time servers and managing their state with Key Event Receipt Infrastructure (KERI), we can completely bypass the TLS chicken-and-egg problem where a client needs the correct time to validate a server's certificate.
> To future-proof such a protocol, we can replace heavy certificate chains with stateless hash-based signatures (SPHINCS+, XMSS^MT) paired with lightweight zkSNARKs. If a node is compromised, its identity can be instantly revoked and globally broadcast via Merkle Tree Certificates and DID micro-ledgers, entirely removing DNS from the security dependency chain.
The system described there I think could replace NTP NTS, DNS, DNSSEC, and maybe CA PKI revocation;
PQ with Merkle Tree certificates