News for hackers. Stuff that matters.

A comment on Calling time on DNSSEC: The costs exceed the benefits. Parent comment

Re:Calling time on DNSSEC: The costs exceed the benefits by jedisct1 on Saturday June 03, 2023 @02:06AM (#36174165)
> DNSCrypt? Sounds good, but the server key is published in the NS record, which gets published in the old cleartext DNS

What is published in DNS records are the public certificates, not their signatures.

[ Parent | on HN ]
Re:Calling time on DNSSEC: The costs exceed the benefits by Luker88 on Saturday June 03, 2023 @02:13AM (#36174192)
yes, but that was my point.

You publish on an unsecure channel(DNS) the public key.

Then, after the resolver gets the key, everything is safe. But getting the key might not be safe at all.

DNSCrypt has been out a couple of years but does not yet have a standard RFC and is not used by the dns root servers.

Or did I miss something in the chain of trust?

[ Parent | on HN ]
Re:Calling time on DNSSEC: The costs exceed the benefits by jedisct1 on Saturday June 03, 2023 @02:27AM (#36174256)
> DNSCrypt has been out a couple of years but does not yet have a standard RFC

https://datatracker.ietf.org/doc/draft-denis-dprive-dnscrypt...

It's not used by DNS root servers because it's designed to secure communications between clients and caches, not between caches and authoritative servers.

[ Parent | on HN ]