Re: High-speed cryptography

Daryl Tester <[email protected]> wrote:
> (These are rhetorical questions, and I really don't want them answered - it
> aids me building my mental model figuring out the answers to these myself).

I wrote this reply before I read that far, so... spoiler alert.

> For example: How does it know the name server is DNSCurve aware?

By the NS name.  If someone has an NS name that looks like a DNSCurve
public key, then a DNSCurve client will send encrypted queries to that
server.  If the server doesn't actually support DNSCurve, and just
happens to have an NS name that makes it look like it does, then those
queries will probably get nxdomain responses - even if they get some
other response, it's extremely unlikely that the response will be
decryptable.  So the client could take that as an indication that the
server doesn't support DNSCurve, and send a normal query instead.  But
I don't see anything on dnscurve.org indicating that a client *should*
do that.

> Are DNSCurve content servers allowed to pass out "traditional" (non-signed)
> answers?

They send conventional, unencrypted responses to conventional,
unencrypted queries, and encrypted responses to encrypted queries.
It's possible that someone could write a malicious server that sent
conventional, unencrypted responses to encrypted queries, revealing
information to anyone sniffing the network about what the client is
asking for.  But a server could publish that information through other
channels just as easily, with or without DNSCurve.


paul