4 ms·
Actually Dan Kaminsky commented on DNSCurve and said it to be very clever and interesting but not realizable because it costs too much. Costs in this sense is t
by Bjoern 17y ago
Actually Dan Kaminsky commented on DNSCurve and said it to be very clever and interesting but not realizable because it costs too much. Costs in this sense is the requirement of machines to realize this. If you substitute the current DNS infrastructure with DNSCurve you need a lot more systems to handle the current load.
(Info)
http://events.ccc.de/congress/2008/Fahrplan/events/2906.en.html http://events.ccc.de/congress/2008/Fahrplan/events/2906.en.h...
(links to mp4, mp3, etc.)
http://events.ccc.de/congress/2008/wiki/Conference_Recordings#H.264 http://events.ccc.de/congress/2008/wiki/Conference_Recording...
(mp4)
http://mirrors.dotsrc.org/congress/25C3/video_h264_720x576/25c3-2906-en-why_were_we_so_vulnerable_to_the_dns_vulnerability?.mp4 http://mirrors.dotsrc.org/congress/25C3/video_h264_720x576/2...
So dnscurve is really great, but if we need two or three times the systems to realize it nobody is going to implement it for real usage.
- khafra 17y agoIt's certainly more involved than plain ol' utterly insecure DNS--but my impression is that it's orders of magnitude easier and cheaper than DNSSEC.
- illumen 17y ago'Using this software, a low-cost PC with a 2.4GHz Core 2 Quad CPU can encrypt and authenticate 50 billion packets/day to 500 million clients. The total load on .com is 38 billion packets/day from 5 million clients.'