• 6 Posts
  • 656 Comments
Joined 3 years ago
cake
Cake day: September 28th, 2023

help-circle















  • thenextguy@lemmy.worldtoHacker News@lemmy.bestiver.seIPv8
    link
    fedilink
    English
    arrow-up
    7
    ·
    3 days ago

    https://www.ietf.org/archive/id/draft-thain-ipv8-00.html

    North-south security – traffic from internal devices to the internet – is enforced at the Zone Server egress by two mandatory validation steps. First, every outbound connection must have a corresponding DNS8 lookup – no DNS lookup means no XLATE8 state table entry means the connection is blocked. Second, the destination ASN is validated against the WHOIS8 registry – if the destination prefix is not registered as an active route by a legitimately registered ASN holder the packet is dropped. These two steps together eliminate the primary malware command-and-control channel: connection to hardcoded IP addresses without DNS resolution.

    At the global routing level, BGP8 route advertisements are validated against WHOIS8 before installation in the routing table. A route that cannot be validated is not installed. Manual bogon filter list maintenance is eliminated. Prefix hijacking is architecturally difficult – an attacker must compromise both an RIR registry entry and produce a validly signed WHOIS8 record.

    This bothers me. It is no longer the Internet as it was. DNS becomes the primary means of addressing, not IP address.