What to do about DNS?
Posted Apr 16, 2007 3:23 UTC (Mon) by intgr
In reply to: What to do about DNS?
Parent article: What to do about DNS?
I did not really understand your concern, but I'll try to make the concept more understandable here.
The approach is generally called self-certifying "names". The idea is that the name is actually a hash of the server's public key.
When you tap in the hash, it gets resolved to an IP through a potentially corruptible authority. However, when connecting to the server itself, it will authenticate to the user with the private key whose public key's hash was embedded in the name. The client can verify this signature and authenticate that the server is the right one, on the assumptions that:
- The client itself is trustworthy
- The server itself is trustworthy
- The source for the name is trustworthy
Note that unlike the current schemes, no intermediaries have to be trusted during usage, at all; it pushes the problem higher up, to the distribution of "names".
to post comments)