Tell me more ×
Bitcoin Stack Exchange is a question and answer site for Bitcoin crypto-currency enthusiasts. It's 100% free, no registration required.
up vote 9 down vote favorite
1

To avoid the problems caused by the current SSL certificate infrastructure, the Electronic Frontier Foundation has proposed Sovereign Keys, which appears to be backed by a distributed, append-only datastructure that can grow to hundreds of gigabytes. That sounds awfully familiar to a block chain. Are there similarities between Sovereign Key and Bitcoin (or Namecoin)? Do they employ a related approach or is this just a superficial similarity?

share|improve this question

1 Answer

up vote 5 down vote

No. Sovereign keys are simply a technical mechanism to use the DNSSEC trust anchors instead of companies like Verisign. Trust is still centralized; it's just centralized in a different place.

share|improve this answer
Note that the "sovereign keys" design document explicitly states that it "bootstraps from and reinforces existing PKI techniques". git.eff.org/… – eldentyrell Dec 19 '11 at 7:27
So the gist is basically that instead of relying on separate entities to issue SSL certificates, you are using the authorities that you already need to trust if you are using DNS? – Thilo Dec 20 '11 at 2:40
2  
If you're using SSL you don't actually trust the DNS system -- you rely on it for a service. Just like you don't trust your ISP, but you rely on them to forward packets for you. The DNS system could return bogus IP addresses just as easily as your ISP could send your packets to the wrong destination. They can deny you service, but cannot deceive you. – eldentyrell Dec 20 '11 at 10:17
So where is this central trust that you speak of located then? And don't I have to trust DNS for DNSSEC trust anchors? – Thilo Dec 20 '11 at 11:41
3  
No. DNSSEC-enabled operating systems ship with the public keys of the centralized DNSSEC root bundled in to the software -- much like how browsers ship with the CA's public keys built in to them. If your DNS provider tries to point you to the wrong server, your DNSSEC-enabled OS will notice because the record that comes back won't be signed correctly. I'm not saying any of this is a good idea, of course; just explaining how DNSSEC works. More info is here: root-dnssec.org – eldentyrell Dec 21 '11 at 7:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.