Hacker News Reader

The DNS traffic doesn't need to be secret ("encrypted"), it just needs to be authenticated (i.e. the payload has not been modified and there is a chain of trust).

If a client is pre-seeded with trusted root keys, DNSSEC protected payload can be validated to the apex.

View on HN

If traffic is end-to-end protected with cryptography --- as, for instance, it is in the SSH protocol --- why does it matter if DNS records are authenticated? If you forge a DNS record, the SSH protocol will kill the session. SSH doesn't even need to care what the DNS says; all that matters are the cryptographic secrets.

I'm going to be generous here and assume they meant authenticated encryption rather than just encryption between the user and the first DNS server they hit.

Which, given how DNSCurve was designed, is a non sequitur :)

Reply on news.ycombinator.com