RSA vs ECDSA for DNSSEC

It has often been said of technology standards that the good thing is that there are just so many to pick from! The same is true, to perhaps a more limited extent, in the world of cryptography. The choices may not be quite so diverse, but there are still many…


On DNS Openness

When we deregulated the telephone industry, we replaced these national monopolies and their vertically bundled structures with a collection of separate enterprises whose actions are orchestrated by market forces rather than by the dictates of the incumbent monopoly telco. This was a comprehensive upheaval to the telecommunications industry, and one…


Fifty Years On

When did the Internet begin? It all gets a bit hazy after so many years, but by the early 1970’s research work in packet switched networks was well underway and while it wasn’t running TCP at the time (the flag day when the ARPANET switched over to use TCP was…


DNSSEC with RSA-4096 Keys

Let’s look at the operation of DNSSEC and its use of public key cryptographic algorithms. The DNSSEC specification does not define in advance which algorithm you should use to generate the digital signature records for a DNSSEC-signed zone. And that’s a very good thing. The issue here is that cryptographic…


Learning from Facebook’s Mistakes

It was only a few weeks back, in July of this year, where I remarked that an Akamai report of an outage was unusual for this industry. It was unusual in that it was informative in detailing their understanding of the root cause of the problem, describing the response that…


IAB Workshop on Measuring Network Quality for End Users

The telephone network had a remarkably clear overriding service objective: It had to sustain a human conversation. Now this must be able to carry a signal which is a human voice. To be discernible to human listeners, its necessary to carry audio frequencies of between 300 and 3,500 Hz. Most…


Regulating Big Tech. This Time, for Sure!

United States President Biden has recently commented: “But let me be very clear: Capitalism without competition isn’t capitalism; it’s exploitation. Without healthy competition, big players can change and charge whatever they want and treat you however they want. […] So, we know we’ve got a problem — a major problem.”…


Another DNS OARC Meeting

These are some notes I took from the DNS OARC meeting held in September 2021. This was a short virtual meeting with six presentations, but for those of us missing a fix of heavy-duty DNS, it was very welcome in any case! DNS Security Mechanisms There isn’t a single approach…


TLS with a side of DANE

Am I really talking to you? In a networked world that’s an important question. For example, where I’m located, when I look up the DNS name www.google.com I get the IPv6 address 2404:6800:4006:813::2004. This implies that when I send an IPv6 packet to this destination address I will reach a…


Running Code

There was an interesting discussion in a working group session at the recent IETF 111 meeting over a proposal that this working group should require at least two implementations (presumably independently developed implementations) of a working group draft before the working group would consider the document ready for submission to…