| |||||||||||||
What to do about DNS?What to do about DNS?Posted Apr 12, 2007 23:07 UTC (Thu) by copsewood (subscriber, #199)In reply to: What to do about DNS? by JohnNilsson Parent article: What to do about DNS?
If you tap in the IP addresses directly instead of using DNS or prefer to use hashes of the IP addresses (just as meaningful as hashes of names like lwn.net) you will still have the problem of there being a limited number of IP addresses and routing authority for blocks of these IP addresses (however many bits if these are of a fixed size) and these address bits being partitioned and delegated hierarchically. So what exactly is the problem you are trying to solve ? Perhaps DNS solves a different problem from the one you had in mind, and perhaps you will need to go deeper than DNS to the routing protocols and internetwork address formats in order to solve your problem.
(Log in to post comments)
What to do about DNS? Posted Apr 16, 2007 3:23 UTC (Mon) by intgr (subscriber, #39733) [Link] I did not really understand your concern, but I'll try to make the concept more understandable here. The approach is generally called self-certifying "names". The idea is that the name is actually a hash of the server's public key. When you tap in the hash, it gets resolved to an IP through a potentially corruptible authority. However, when connecting to the server itself, it will authenticate to the user with the private key whose public key's hash was embedded in the name. The client can verify this signature and authenticate that the server is the right one, on the assumptions that:
Note that unlike the current schemes, no intermediaries have to be trusted during usage, at all; it pushes the problem higher up, to the distribution of "names".
What to do about DNS? Posted Apr 16, 2007 6:35 UTC (Mon) by dlang (✭ supporter ✭, #313) [Link] this sounds like exactly the same problem that you have today with SSL certs.
if you assume that the client, server, and trusted third party are all intact then you don't have anything to worry about.
no need to add another layer (with the dns) with the same limitations.
|
|||||||||||||