4 ms·
Does anyone who's got some background with DNSSEC (https://en.wikipedia.org/wiki/Dnssec https://en.wikipedia.org/wiki/Dnssec) feel like comparing DNSChain to th
by nieve 13y ago
Does anyone who's got some background with DNSSEC (https://en.wikipedia.org/wiki/Dnssec https://en.wikipedia.org/wiki/Dnssec) feel like comparing DNSChain to the basic idea of embedding certificates or signatures in authenticated DNS records? We've had a lot of different proposals for the latter over the years and my impression is their lack of adoption hasn't been because DNSSEC is fundamentally broken (though it is flawed in several ways). AFAICT it breaks down like this:
Against DNSSEC + certificate records:
1) There's a centralized PKI administration issue, but less so than the current CA morass
2) Administrative/rubber hose/legal/monetary compromise of the DNS root administrators (currently US NTIA) would allow substitution of the TLD keys, but this would be blatantly obvious to every organization or individual paying attention
3) DNSSEC has some annoying properties with regard to name enumeration and such
4) Need to either use a primary resolver that supports DNSSEC (Google Public DNS and Comcast, among others) or do a separate query to one who does
For:
5) Minimal extra infrastructure, already supported in some libraries
6) Extremely cacheable with low resource requirements (root & TLD keys, MRU/MFU certs)
7) No need to add a new dependency on a previously untrusted source of code and crypto data
8) As long as the parent TLD has deployed DNSSEC the organization only needs to get their key set up, add a theoretical cert record, and sign records as needed.
I think issues 1 & 2 are at least as big a problem with DNSChain because in practice the hand-waving of how you pick a trusted DNSChain chain is ignoring a huge class of vulnerabilities. Issue 4 is still a win over implementing a large chunk of infrastructure or trusting okTurtles'. The "just use Javascript" bit seems to apply equally to either, though I guess the _query_ portion of DNSChain is relatively simple.