Subject: Decentralising the DNS

From: Sabahattin Gucukoglu <[email-masked]>
Date: Fri, 12 Jun 2009 15:55:05 +0100

Silly question, I'm sure - any chance of putting the DNS into a  
gigantic DHT and spreading the entry nodes liberally about the planet?

Cheers,
Sabahattin

PS: No political agenda implied.

---

From: "Tschofenig, Hannes (NSN - FI/Espoo)" <[email-masked]>
Date: Fri, 12 Jun 2009 18:43:43 +0300

The idea to put something into a DHT has been suggest for almost
everything by now, including the DNS. If you search for "DHT DNS" then
you can find a couple of papers. 

Ciao
Hannes

>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]] On 
>Behalf Of ext Sabahattin Gucukoglu
>Sent: 12 June, 2009 17:55
>To: [email-masked]
>Subject: Decentralising the DNS
>
>Silly question, I'm sure - any chance of putting the DNS into 
>a gigantic DHT and spreading the entry nodes liberally about 
>the planet?
>
>Cheers,
>Sabahattin
>
>_______________________________________________
>Ietf mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/ietf
>

---

From: Sabahattin Gucukoglu <[email-masked]>
Date: Fri, 12 Jun 2009 17:30:57 +0100

> you can find a couple of papers.

Thanks, but it actually occurred to me that it didn't solve the  
problem of authority, which is really the source of the DNSSec  
trouble.  (Can't say I'm all bothered about the current situation;  
it's been this way for years, after all, and there's still a release  
mechanism.)  The issue was trust, and the need for delegaters to  
control what they delegated, unless of course we change the whole  
registration model.  Hmm - might be more than the 'net can stand just  
at the moment.

Cheers,
Sabahattin

---

From: Bill Manning <[email-masked]>
Date: Fri, 12 Jun 2009 10:32:10 -0700

> PS: No political agenda implied.

	been proposed quite a few times over the years in one
	form or another.  

--bill

Opinions expressed may not even be mine by the time you read them, and
certainly don't reflect those of any other entity (legal or otherwise).

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 12 Jun 2009 19:32:34 -0400

The .com zone already has multiple entry nodes. Maybe not the design
you would propose though...

Given the relatively small size of the zone files compared to the
memory capacity of modern machines, you can argue for a one or two
tier system depending on your hardware platform characteristics. DNS
was designed to work within the constraints of a single tier
architecture, it has grown above the rate of Moore's law at times, but
is not growing at that rate recently.

DNS lookups are highly concentrated in a subset of domains. A more
appropriate architecture for the DNS would be a 1.5 tier architecture
where the front end servers maintain the x% of domains that answer 99%
of queries locally and go to second tier systems for the other 1%.

You say you have no political agenda, but a change of that magnitude
would have to be driven by a powerful political incentive.

A lot of the costs of running core DNS come from the cost of dealing
with large scale malicious attacks. Here there is a problem with the
economics of the Internet, the ISPs have little incentive to stop
botnets on their local networks mounting DDoS attacks on the DNS roots
as they would bear the costs while the registry sees the benefit.

ANYCAST has an interesting effect in that it means that ISPs who
negligently allow botnets to perform DDoS attacks are going to see
their own network response impacted in direct proportion.

A network architecture in which the large ISPs received the major DNS
feeds as zone transfers and took charge of the local distribution
themselves would be a lot more resilient than the current arrangement.
Unfortunately our current political constraints lock us into an
architecture that is unnecessarily vulnerable to DDoS attack and does
not impose accountability on the sources of that attack. Nor are AOL,
Comcast etc going to be too interested in taking on the costs of
distributing DNS locally unless ICANN is willing to share some of that
$6.50 per domain revenues.

As with a lot of Internet economics, it makes little sense unless you
start to try to propose something better. At root is the problem that
each communication has two sides and it is not at all clear which side
is obtaining the real value from the communication. In the telephone
system the assumption is (usually) that the initiator of the call is
getting the value. In the Internet the costs are too small to measure
at the fine grain level but enormous when aggregated.

On Fri, Jun 12, 2009 at 10:55 AM, Sabahattin
Gucukoglu<[email-masked]> wrote:
> Silly question, I'm sure - any chance of putting the DNS into a gigantic DHT
> and spreading the entry nodes liberally about the planet?
>
> Cheers,
> Sabahattin
>

-- 
-- 
New Website: http://hallambaker.com/
View Quantum of Stupid podcasts, Tuesday and Thursday each week,
http://quantumofstupid.com/

---

From: Christian Huitema <[email-masked]>
Date: Fri, 12 Jun 2009 11:26:40 -0700

> From: Bill Manning, Friday, June 12, 2009 10:32 AM 

It is indeed technically possible to develop a worldwide distributed service -- check http://en.wikipedia.org/wiki/PNRP for an example. However, a pure P2P implementation immediately bumps against the question of authority. Who gets to publish the address for www.example.com"? I you allow "anybody", the system can become really unreliable. If you request a certificate to "certify" the publishing, you get all the generic PKI issues, e.g. who to trust, etc., and you end up with a system that is not much more P2P than the DNS. 

The only "secure" solution that we could deploy uses large numbers instead of names, where the number is essentially a hash of a self-signed certificate. That works, for some definition of working: if you know what number to retrieve, you will get an authoritative answer. But that means using large numbers instead of short friendly names, and thus is not very "user-friendly".

-- Christian Huitema

---

From: Tony Finch <[email-masked]>
Date: Tue, 16 Jun 2009 15:17:52 +0100

On Fri, 12 Jun 2009, Christian Huitema wrote:
>
> The only "secure" solution that we could deploy uses large numbers
> instead of names, where the number is essentially a hash of a
> self-signed certificate. That works, for some definition of working: if
> you know what number to retrieve, you will get an authoritative answer.
> But that means using large numbers instead of short friendly names, and
> thus is not very "user-friendly".

Another alternative is to use local relative names instead of global
names, as in the Unmanaged Internet Architecture.
	http://pdos.csail.mit.edu/uia/

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
GERMAN BIGHT HUMBER: SOUTHWEST 5 TO 7. MODERATE OR ROUGH. SQUALLY SHOWERS.
MODERATE OR GOOD.