| |||||||||||||
What to do about DNS?What to do about DNS?Posted Apr 16, 2007 3:23 UTC (Mon) by intgr (subscriber, #39733)In reply to: What to do about DNS? by copsewood Parent article: What to do about DNS?
I did not really understand your concern, but I'll try to make the concept more understandable here. The approach is generally called self-certifying "names". The idea is that the name is actually a hash of the server's public key. When you tap in the hash, it gets resolved to an IP through a potentially corruptible authority. However, when connecting to the server itself, it will authenticate to the user with the private key whose public key's hash was embedded in the name. The client can verify this signature and authenticate that the server is the right one, on the assumptions that:
Note that unlike the current schemes, no intermediaries have to be trusted during usage, at all; it pushes the problem higher up, to the distribution of "names".
(Log in to post comments)
What to do about DNS? Posted Apr 16, 2007 6:35 UTC (Mon) by dlang (✭ supporter ✭, #313) [Link] this sounds like exactly the same problem that you have today with SSL certs.
if you assume that the client, server, and trusted third party are all intact then you don't have anything to worry about.
no need to add another layer (with the dns) with the same limitations.
|
|||||||||||||