Re: [Resolverless-dns] Paper on Resolver-less DNS

[Paul Vixie <[e-mail]>]

On Friday, 16 August 2019 15:25:32 UTC Steffen Nurpmeso wrote:
> ...
> 
> I do not understand, and never (~18 years) did, why the complexity
> of DNS is increased so much; instead of moving over to secure
> transport that is.

DNS over TLS (note, this is not the same as DNS over HTTPS) is such a 
transport. however, transport security doesn't assure data authenticity. 
therefore the another complexity (DNSSEC) was added first. and, neither of 
these protocols can be used to express permission, so another complexity 
(TSIG) was added before either of the others.

> And if you want to sign data bundles, then
> those keys could also be used, they have the potential for it, do
> they.

no. both for reasons of caching and reasons of policy and monitoring, most DNS 
transactions are bounced through relays called "full resolvers". if you try to 
design these out, your system will lose vital properties compared to DNS 
itself.

> Repeatedly connect up to the root domain of your URL in
> question, and collect certificates along the way, unless you have
> the complete chain, which you can cache locally.  Especially if
> you now even pump the data as such over an already open HTTP
> channel.  But in general this looked to me the much more elegant
> resolution (once i looked at DNSSEC and TSIG and said "no
> (hopefully not)").  And much easier to implement, and by using
> facilities of libraries which see many eyes.  And keeping the core
> protocol clean.

the losses from this approach would be, as stated above, vital.

the web isn't by far the only app running on the internet, and while it will 
grow, the internet is larger will grow faster.

-- 
Paul