Re: [OT: DNSCurve] Resolvers w/o key -> HMAC Proposal

Hi,

(I need to answer my own question)

--On Sunday, December 06, 2009 11:43:42 +0100 Erwin Hoffmann 
<[email protected]> wrote:

> Good morning,
>
> since there is no official discussion list on DNSCurve I try my question
> here.
>
> Current: DNSCurve requires that both the DNSCurve Sever as well Responder
> do encrypt their DNS messages with the public key of the peer. In fact,
> DNSCurve builds it's own infrastructure on top of public DNS and aside
> from DNSSec.
>
> Question: Wouldn't it be enough if the the DNSCurve Server has a Key ?

Well. My assumption (which I didn't tell) here was that *BOTH* the DNSCurve 
Cache and the Forwarder have to have a 'published' PubKey in the DNS.
This is not true. Only the Cache Server needs it's PubKey to be "uz5...." 
available as RDATA in the NS Resource Record (actually Section 3.4 of 
Matthew's draft sould say that more clearly).

The PubKey of the Forwarder is 'unpublished' in this sense.
Thus my question/proposal is obsolete.
Due to the common crypto_box functionality, there is no need to use the 
HMAC stuff in particular.
However it would be interesting to have a comparison in speed/CPU 
consumption. It is the Cache which is under heavy load. To reduce 
cpu-cycles w/o reducing security would be certainly a valid goal.

Maybe, this is to be considered for level "uz6" DNSCurve protocols.

Thanks folks.

regards.
--eh.