Subject: [DNSOP] I think we may have a solution - DNSCurve

From: "Joe Baptista" <[email-masked]>
Date: Sun, 31 Aug 2008 15:20:51 -0400

http://dnscurve.org/

comments?

cheers
joe baptista

-- 
Joe Baptista
www.publicroot.org
PublicRoot Consortium
----------------------------------------------------------------
The future of the Internet is Open, Transparent, Inclusive, Representative &
Accountable to the Internet community @large.
----------------------------------------------------------------
Office: +1 (360) 526-6077 (extension 052)
Fax: +1 (509) 479-0084
http://dnscurve.org/

comments?

cheers
joe baptista

-- 
Joe Baptista
www.publicroot.org
PublicRoot Consortium
----------------------------------------------------------------
The future of the Internet is Open, Transparent, Inclusive, Representative &
Accountable to the Internet community @large.
----------------------------------------------------------------
Office: +1 (360) 526-6077 (extension 052)
Fax: +1 (509) 479-0084
_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

---

From: "Ondřej Surý" <[email-masked]>
Date: Sun, 31 Aug 2008 21:50:51 +0200

> comments?

I already made comments on namedroppers, so I will summarize it here:

1. no trust anchors in design, signatures seems to be loosely connected.
   Djb added page for TLD operators today, where he proposes signing .com
   and ISPs to keep local copies of root zone.  But still DNSCurve doesn't
   protect you when your parent is not using DNSCurve (or DNSSEC), but you
   can get false sense of security (just read those pages).  Unfortunatelly
   DNSCurve key is received by PODS - thus it's not protected

2. In it's ideal state it would change DNS to DNS over DNS-TXT.  It would
   be nearly impossible to debug anything at all.  And personally I don't
   like this type of encapsulation (it reminds me IP over DNS ;)).

3. Requirements on aDNS server computation power is raised.  Now not only
   recursor, but also authoritative nameserver does crypto.  Elliptic
   curve crypto may have less requirements on cpu cycles, but still it
   adds more burden on authoritative nameservers.  Djb also proposes
   to change .com nameservers so they are grouped together.

4. I am not sure if labels like
uz51gmc1jjicekrm676rorncvjpale915vhd94bj2fddj1be1ntbg5.root-servers.net
   make things more simpler.

Ondrej.
-- 
 Ondřej Surý
 technický ředitel/Chief Technical Officer
 -----------------------------------------
 CZ.NIC, z.s.p.o. -- .cz domain registry
 Americká 23,120 00 Praha 2,Czech Republic
 mailto:[email-masked] http://nic.cz/
 sip:[email-masked] tel:+420.222745110
 mob:+420.739013699 fax:+420.222745112
 -----------------------------------------
_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

---

From: "Ondřej Surý" <[email-masked]>
Date: Sun, 31 Aug 2008 21:50:51 +0200

Ondrej.

---

From: David Conrad <[email-masked]>
Date: Sun, 31 Aug 2008 13:21:31 -0700

> 2. In it's ideal state it would change DNS to DNS over DNS-TXT.
> 3. Requirements on aDNS server computation power is raised.
> 4. I am not sure if labels like [...] make things more simpler.

5. I suspect having encryption will make getting export licenses more  
complicated.  In the past, this used to be a big annoyance.  Not sure  
how much a consideration it is today (but would be surprised if things  
are easier now then they were when I had a couple of lawyers look at  
it for DNSSEC (which doesn't have encryption)) and it may or may not  
be a significant consideration for the Unbound/PowerDNS folks.

Don't know enough about DNSCurve as yet, but it definitely looks  
interesting.

Regards,
-drc

---

From: David Conrad <[email-masked]>
Date: Sun, 31 Aug 2008 13:21:31 -0700

Regards,
-drc

---

From: bert hubert <[email-masked]>
Date: Sun, 31 Aug 2008 22:34:51 +0200

> it for DNSSEC (which doesn't have encryption)) and it may or may not  

Technically, this may be true - but I got into trouble over an AES-based
random generator, even though it does not encrypt any user supplied data.

Having RSA or AES in your binary is enough to get people worried - even
though this is not justified. Export law is crazy but not that crazy.

It does create problems though.

	Bert

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://netherlabs.nl              Open and Closed source services
_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

---

From: bert hubert <[email-masked]>
Date: Sun, 31 Aug 2008 22:34:51 +0200

Bert