Subject: [therightkey] Transitioning the web to Namecoin/DNSNMC by addressing name-squatters

From: Tao Effect <[email-masked]>
Date: Sat, 21 Dec 2013 21:04:52 -0500

From the proposal [1]:

The only criticism of relevance that I have received (so far) from those reviewing DNSNMC is that people do not like domain squatters and therefore do not want to switch to a system where all the existing trademarked and copyrighted names have already been registered:

https://www.reddit.com/r/netsec/comments/1t20wi/therightkey_dnsnmc_deprecates_certificate/ce45865
http://lists.randombit.net/pipermail/cryptography/2013-December/005959.html
http://lists.randombit.net/pipermail/cryptography/2013-December/005960.html

I think this is one of the main things that is holding Namecoin back from widespread adoption, and therefore we must address this issue.

Herein I propose a very simple method to address this problem:

namecoind must be modified to give existing TLDs special treatment in a way that paves for a smooth transition from today's DNS, to a Namecoin-based DNS like DNSNMC.

New namespaces will be created for each of today's TLDs, and only the owners of those domains (in the deprecated, old DNS system) can register them. For example, only the owners of apple.com can register com/apple, etc. Proof of ownership is done by special NMC DNS records that contain the owner's cryptographic signature/fingerprint. When Namecoin clients receive a notification that someone wants to register a domain in the com namespace, they check the JSON request to verify that it was signed by the same signature that appears in the old DNS records. If they match, the registration request is accepted and added to their local blockchain. If it does not match, the request is discarded. Similarly, the namecoin client itself will perform this check locally before sending out the request to other peers (to provide instant feedback to users attempting to register something that doesn't belong to them).

Thoughts?

[1]: http://dot-bit.org/forum/viewtopic.php?f=5&t=1439

--
Please do not email me anything that you are not comfortable also sharing with the NSA.

---

From: Tao Effect <[email-masked]>
Date: Sat, 21 Dec 2013 21:46:17 -0500

On Dec 21, 2013, at 9:12 PM, Seth Schoen <[email-masked]> wrote:

> Sovereign Keys (which has similar aims to Namecoin) has a similar
> mechanism to this, and for the same reasons.

Nice! :-)

Correct me if I'm wrong though, but from what I remember when I researched Sovereign Keys, that system still preserves today's CAs, is that correct?

In other words, people still have to pay money every year to random third parties to keep themselves secure?

Is that correct?

On Dec 21, 2013, at 9:12 PM, Seth Schoen <[email-masked]> wrote:

> Tao Effect writes:
> Sovereign Keys (which has similar aims to Namecoin) has a similar
> mechanism to this, and for the same reasons.  The SK idea is that an
> initial registration of a name in SK should include cryptographic
> proof of ownership of the name according to the conventional Internet
> naming systems (via a cryptographic binding to PKIX or DNSSEC).
> 
> "Claiming a key for a name requires evidence of control in the DNS
> (either a CA-signed certificate or a key published by DANE DNSSEC)."
> 
> https://git.eff.org/?p=sovereign-keys.git;a=blob;f=sovereign-key-design.txt;hb=master
> 
> -- 
> Seth Schoen  <[email-masked]>
> Senior Staff Technologist                       https://www.eff.org/
> Electronic Frontier Foundation                  https://www.eff.org/join
> 815 Eddy Street, San Francisco, CA  94109       +1 415 436 9333 x107