DNSSEC vs. DNSCurve

Abstract

Without a doubt, Domain Name System (DNS) security is a complicated topic of growing concern. In fact, it can be argued that the whole Internet infrastructure depends on the smooth operation of the DNS service. Despite this fact, the original DNS design concentrated on availability, not security, and thus included no authentication. Nowadays, this security gap has been addressed by two cryptographic mechanisms: DNSSEC and DNSCurve. They both utilize public key cryptography and extend the core DNS protocol. Although the second mechanism is still in its infancy while the first is well-standardized, they are both promising and are quite likely to compete with each other in the near future to gain acceptance. This work aims to provide a comprehensive and constructive comparison between the aforementioned security mechanisms. Towards this direction, the authors theoretically cross-evaluate and assess the benefits and the drawbacks of each particular mechanism based on several distinct criteria. This is necessary in order to decide which mechanism is the best fit for each particular deployment.