1

I'm interested in the most secure and reliable Namecoin DNS resolution as possible, although I admit I don't fully understand how these concepts relate to each other (Namecoin and DNS)

Is DNSSec needed or possible with Namecoin based DNS services? Would that come at a higher "cost" (more namecoins are needed?)

Improve this question
8
  • Do you mean TLS/SSL? – kermit Mar 24 '13 at 14:18
  • @phelix No. A hacked DNS makes TLS/SSL insecure. DNSSec prevents a hacked DNS and makes TLS/SSL (HTTPS) more secure – halfbit Mar 24 '13 at 15:47
  • I meant TLS/SSL via namecoin. How could namecoin dns NOT be secure? It is blockchain-secured. – kermit Mar 24 '13 at 22:09
  • @phelix The link between the host and the recursive resolver is the weak link and can be hacked. Not the resolver and the namecoin lookup proxy (not Bind <--> namecoind) – halfbit Mar 24 '13 at 22:46
  • @phelix So when is Namecoin going to get a reboot? I think you're one of the devs there no? Reboot = different design. – halfbit Mar 24 '13 at 22:46
1

No DNSSec is not needed with Namecoin. The mapping from name to IP cannot be forged.

However, DNSSec requires changes to resolver libraries so the domains are actually cryptographically verified.

Namecoin, to be secure, requires similar changes to resolver libraries because nothing in the current resolver libraries actually checks the integrity of the results.

Anyone can run software to verify that a traditional (insecure, no cryptography) nameserver that resolves .bit addresses actually return addresses corresponding to the blockchain.

Thus namecoin name servers can be ensured to not "fool all the people all the time" by having some servers that continuously check the integrity of the results produced by the insecure but backwards compatible nameserver.

Improve this answer
1
  • 1
    This answer is incomplete. Yes, Name/IP mappings in Namecoin are protected, but if you use the 'ns' type instead of 'ip', this is like an insecure delegation in DNSSEC - making the original question valid. – Habbie Oct 7 '13 at 9:24
0

If you wish to use DANE to secure TLS then yes, you will need DNSSEC. In absense of certificate authorities, that probably is a good idea.

https://github.com/hlandau/ncdns has some hints, but I suspect it is a little more complex than that, they deal with the DNSSEC enforcing recursive resolver.

Software that DNSSEC validates itself (such as the FireFox add-on) will need to be told how to trust the DS records as they will not descend from the ICANN root.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.