Take the 2-minute tour ×
Bitcoin Stack Exchange is a question and answer site for Bitcoin crypto-currency enthusiasts. It's 100% free, no registration required.

I'm interested in the most secure and reliable Namecoin DNS resolution as possible, although I admit I don't fully understand how these concepts relate to each other (Namecoin and DNS)

Is DNSSec needed or possible with Namecoin based DNS services? Would that come at a higher "cost" (more namecoins are needed?)

share|improve this question
    
Do you mean TLS/SSL? –  phelix Mar 24 '13 at 14:18
    
@phelix No. A hacked DNS makes TLS/SSL insecure. DNSSec prevents a hacked DNS and makes TLS/SSL (HTTPS) more secure –  makerofthings7 Mar 24 '13 at 15:47
    
I meant TLS/SSL via namecoin. How could namecoin dns NOT be secure? It is blockchain-secured. –  phelix Mar 24 '13 at 22:09
    
@phelix The link between the host and the recursive resolver is the weak link and can be hacked. Not the resolver and the namecoin lookup proxy (not Bind <--> namecoind) –  makerofthings7 Mar 24 '13 at 22:46
    
@phelix So when is Namecoin going to get a reboot? I think you're one of the devs there no? Reboot = different design. –  makerofthings7 Mar 24 '13 at 22:46
show 3 more comments

1 Answer

No DNSSec is not needed with Namecoin. The mapping from name to IP cannot be forged.

However, DNSSec requires changes to resolver libraries so the domains are actually cryptographically verified.

Namecoin, to be secure, requires similar changes to resolver libraries because nothing in the current resolver libraries actually checks the integrity of the results.

Anyone can run software to verify that a traditional (insecure, no cryptography) nameserver that resolves .bit addresses actually return addresses corresponding to the blockchain.

Thus namecoin name servers can be ensured to not "fool all the people all the time" by having some servers that continuously check the integrity of the results produced by the insecure but backwards compatible nameserver.

share|improve this answer
    
This answer is incomplete. Yes, Name/IP mappings in Namecoin are protected, but if you use the 'ns' type instead of 'ip', this is like an insecure delegation in DNSSEC - making the original question valid. –  Habbie Oct 7 '13 at 9:24
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.