dnscurve and DNS hardening, was Re: Dan Kaminsky

Thu Aug 6 02:05:24 UTC 2009

On Wed, Aug 05, 2009 at 09:17:01PM -0400, John R. Levine wrote:
> ...
>
> It seems to me that the situation is no worse than DNSSEC, since in both 
> cases the software at each hop needs to be aware of the security stuff, or 
> you fall back to plain unsigned DNS.

I might misunderstand how dnscurve works, but it appears that dnscurve
is far easier to deploy and get running. The issue is merely coverage.
How much of DNS do you want to protect. This is analagous to SMTP
security, the more MTAs that support TLS the proportional increase
of security in the system as a whole. Dnscurve appears to be another
form of opportunistic encryption, the more servers that employ dnscurve
means an accretion in security of DNS as a whole.