<p>No.  Sovereign keys are simply a technical mechanism to use the <a href="http://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions#Trust_anchors_and_authentication_chains">DNSSEC trust anchors</a> instead of companies like Verisign.  Trust is still centralized; it's just centralized in a different place.</p>

CC BY-SA 3.0
2011-12-19T07:27:38.163Z
Note that the "sovereign keys" design document explicitly states that it "bootstraps from and reinforces existing PKI techniques".  https://git.eff.org/?p=sovereign-keys.git;a=blob;f=sovereign-key-design.txt;hb=HEAD
eldentyrell
CC BY-SA 3.0
2011-12-20T02:40:39.230Z
So the gist is basically that instead of relying on separate entities to issue SSL certificates, you are using the authorities that you already need to trust if you are using DNS?
Thilo
CC BY-SA 3.0
2011-12-20T10:17:54.357Z
If you're using SSL **you don't actually *trust* the DNS system** -- you rely on it for a service.  Just like you don't trust your ISP, but you rely on them to forward packets for you.  The DNS system could return bogus IP addresses just as easily as your ISP could send your packets to the wrong destination.  They can deny you service, but cannot deceive you.
eldentyrell
CC BY-SA 3.0
2011-12-20T11:41:41.273Z
So where is this central trust that you speak of located then? And don't I have to trust DNS for DNSSEC trust anchors?
Thilo
CC BY-SA 3.0
2011-12-21T07:46:10.990Z
No.  DNSSEC-enabled operating systems ship with the public keys of the centralized DNSSEC root bundled in to the software -- much like how browsers ship with the CA's public keys built in to them.  If your DNS provider tries to point you to the wrong server, your DNSSEC-enabled OS will notice because the record that comes back won't be signed correctly.  I'm not saying any of this is a good idea, of course; just explaining how DNSSEC works.  More info is here: http://www.root-dnssec.org/
eldentyrell
CC BY-SA 3.0
2011-12-19T07:25:50.567Z
2011-12-19T07:25:50.567Z
eldentyrell
<p>To avoid the problems caused by the current SSL certificate infrastructure, the Electronic Frontier Foundation has proposed <a href="https://www.eff.org/deeplinks/2011/11/sovereign-keys-proposal-make-https-and-email-more-secure">Sovereign Keys</a>, which appears to be backed by a distributed, append-only datastructure that can grow to hundreds of gigabytes. That sounds awfully familiar to a block chain. Are there similarities between Sovereign Key and Bitcoin (or Namecoin)? Do they employ a related approach or is this just a superficial similarity?</p>

<blockchain><namecoin>
Is EFF's proposed Sovereign Key system similar to how Namecoin/Bitcoin works?
Thilo
# Is EFF's proposed Sovereign Key system similar to how Namecoin/Bitcoin works?

(Asked by: username_0 on 2011-12-19)

To avoid the problems caused by the current SSL certificate infrastructure, the Electronic Frontier Foundation has proposed [Sovereign Keys](https://www.eff.org/deeplinks/2011/11/sovereign-keys-proposal-make-https-and-email-more-secure), which appears to be backed by a distributed, append-only datastructure that can grow to hundreds of gigabytes. That sounds awfully familiar to a block chain. Are there similarities between Sovereign Key and Bitcoin (or Namecoin)? Do they employ a related approach or is this just a superficial similarity?

**Tags:** blockchain, namecoin


---

## 1 answers

### Answer by username_1 on 2011-12-19. Score: 5

No. Sovereign keys are simply a technical mechanism to use the [DNSSEC trust anchors](http://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions#Trust_anchors_and_authentication_chains) instead of companies like Verisign. Trust is still centralized; it's just centralized in a different place.

> **Comments:**
> **username_1**: Note that the "sovereign keys" design document explicitly states that it "bootstraps from and reinforces existing PKI techniques".  https://git.eff.org/?p=sovereign-keys.git;a=blob;f=sovereign-key-design.txt;hb=HEAD  
> **username_0**: So the gist is basically that instead of relying on separate entities to issue SSL certificates, you are using the authorities that you already need to trust if you are using DNS?  
> **username_1**: If you're using SSL **you don't actually *trust* the DNS system** -- you rely on it for a service.  Just like you don't trust your ISP, but you rely on them to forward packets for you.  The DNS system could return bogus IP addresses just as easily as your ISP could send your packets to the wrong destination.  They can deny you service, but cannot deceive you.  
> **username_0**: So where is this central trust that you speak of located then? And don't I have to trust DNS for DNSSEC trust anchors?  
> **username_1**: No.  DNSSEC-enabled operating systems ship with the public keys of the centralized DNSSEC root bundled in to the software -- much like how browsers ship with the CA's public keys built in to them.  If your DNS provider tries to point you to the wrong server, your DNSSEC-enabled OS will notice because the record that comes back won't be signed correctly.  I'm not saying any of this is a good idea, of course; just explaining how DNSSEC works.  More info is here: http://www.root-dnssec.org/  

---

