Hacker News Reader

Comment by dpark | Hacker News Reader

How does the blockchain solve the problems with CAs?

Haven't you heard, you can solve any problem by throwing a blockchain at it! ;-)

On a more serious note, Certificate Transparency, which will become mandatory in Chrome in about a year, uses technology that is strongly related to blockchains, so we're really not too far from a blockchain-like solution for the Web PKI.

I agree that CT uses a technology related to blockchains, but as I noted above, Ben Laurie has been pretty vocal in saying that the Bitcoin-style PoW blockchain isn't a technology that he favors, and I think he thinks CT is importantly different in some respects (for example in accepting more centralization in the operation of logs: an uninvolved anonymous party can't show up and "mine" a CT log event).

http://www.links.org/files/decentralised-currencies.pdf

A global, permanent, public, append-only log for 11 cents a record is pretty useful.

Not the OP, but I imagine he has something like namecoin in mind. Domains are tied to cryptographic keys which are also used for encryption+authentication, and the blockchain stores the mapping of names to keys.

It's not ready for primetime, and it has its own issues. I don't really see it gaining much traction. But it does present an alternative approach to the problem.

How do you tie a domain to a key in this model? That's the specific thing that CAs do. The Wikipedia article seems to hand wave over this and I don't see an obvious answer on the namecoin site (though I assume it's there if I dig enough).

You register a domain by spending namecoin in a reg tx, which becomes immutable in the bc. Problem is that when a court says Cocacola.blockchain_namespace is the legal property of the Coke, and the owner is some kid in China who won't hand over the keys, no Corp would use it for DNS.

Names should be strong to prevent spoofing but not so strong that squatters and unlawful holders of keys can disrupt their legitimacy.

So basically it doesn't at all solve the problem. Immutable domain names are not a good thing in general (though certainly in specific cases it could be), especially when as you noted squatting is inevitable.

I don't know if there are established formats to do it, but you would publish the public key in the namecoin record of your domain. You can only do that if you currently own the name in the namecoin chain, similar to how DANE would put a key into DNS.

Reply on news.ycombinator.com