Subject: [dnsext] Nominum doing something DNSCurve-y?

From: Matthew Dempsky <[email-masked]>
Date: Mon, 14 Sep 2009 13:29:43 -0700

A coworker discovered this earlier today:

    $ dig +short -t ns skyebynominum.com
    zq708vote6hqo5uvbi2pult2dutvjq0u5evd075o9n214m3e15fltha0.skyedns.com.
    zq70nmpntigu1dusbi446et0l8lb4c172rkrqnchm1i635nr058ovkvg.skyedns.com.
    zq70rdqlv91r6t7lu5vk527cjhn3ha7qgtqoo24tsrikbt8fdvurjhi0.skyedns.com.
    zq70sn1287vcrbj1hgvihec8rgisjok385rrptc45magateh14409gtg.skyedns.com.

It looks similar to DNSCurve, except with the magic string "zq70"
instead of "uz5" and using RFC 4648's base32hex instead of DNSCurve's
base-32 encoding.  When decoded, this yields a 32 byte string, and the
high bit of the last byte of each string is cleared: just like a
Curve25519 public key.  (Of course, this could also be coincidental.)

I tried sending a DNSCurve streamlined query to one of the name
servers, but it was rejected with a FORMERR.

Does anyone know more about this?  Maybe not actually DNSCurve-y at all?

---

From: =JeffH <[email-masked]>
Date: Tue, 22 Sep 2009 17:28:24 -0700

> Does anyone know more about this?  Maybe not actually DNSCurve-y at all?

Huh, innaresting.

Note the "skyedns.com" domain -- the records above might have something to do 
with the announcement nominum made today (which mentions dnssec and security)..

Nominum Rolls Out SKYE DNS Cloud Services
SKYE offers a suite of cloud-based services to address infrastructure and new 
service needs
http://www.darkreading.com/securityservices/security/showArticle.jhtml?articleID=220100568

=JeffH
disclaimer: I have no relationship with Nominum at all, AFAIK. I simply 
stumbled across Matthew's msg whilst poking about for info wrt skye.