DFINITY Foundation

Internet Computer Association

Build long term R&D efforts for Decentralized CA and DNS (from which multiple projects will emerge)

# Decentralized CA and DNS

## Summary

**Background:** The Internet Computer (IC) offers dapp developers a possibility to build and host Web dapps on the Internet Computer that are served completely end-to-end from the blockchain to a browser.

To ensure end-2-end security and verifiability of such content one needs to make decentralized blockchain-based certification compatible with the built-in browser tooling and verification mechanisms. Currently this is achieved by using additional software, so called service workers, certified by  "Let’s Encrypt ", which is one of the centralized certificate authorities (CA) accepted by browsers. There are also no built-in mechanisms to use custom domains for canister smart contracts running on Internet Computer.

**Objective:** This project aims to provide mechanisms that ensure custom domain names and seamless verification of the content that is served from the Internet Computer blockchain to any browser and guarantee end-2-end security without additional tooling, using built-in mechanisms only. This includes making the IC a decentralized Certificate Authority and providing a decentralized DNS on the IC.

## Why this is important and why the DFINITY Foundation should make this a long-running R&D project

All current PKI systems used by the browsers assume centralized trusted third parties to serve as roots of trust (certificate authorities). To achieve true decentralization it is important to enable a decentralized system to act as a root of trust and interface with the current tooling to allow using it seamlessly and securely.

Becoming a decentralized CA is not just technically challenging: besides implementing cryptographic operations in a distributed fashion (for example, using threshold signatures instead of simple signatures) it also requires work and cooperation with browser manufacturers to complete the process of becoming a (root) CA supported by different browsers. The latter especially takes time and also support from the legal and compliance teams.

## Key milestones & topics under this project

The project aims to achieve this goal via multiple steps (milestones):

1. Make the Internet Computer serve as a decentralized CA
   1.1 Technical enablement:
      -  Develop and implement multi-party computation protocols for TLS handshake
      - Develop and implement multi-party computation protocols for certifying the content (this includes the threshold ECDSA work that is in progress)
   
   1.2. Process and registration:
      - Apply to serve as a subordinate CA
      - Apply to serve as a root CA (to be able to certify any domain).

2. Enable decentralized DNS support for canister smart contracts hosted on IC
3. Ensure seamless content verification support for different platforms and browsers (via web or native Apps) with strong security guarantees. This includes integration with boundary nodes (see also Boundary Node project proposal).


## Skills and Expertise necessary to accomplish this

The problems described above require the cooperation of different experts: from researchers and engineerings working on Cryptography, PKI, Networking, and Web technologies (to build the technical foundation) to specialists in Security, Compliance and Legal (to ensure that the Internet Computer can serve as a decentralized CA and DNS service).

## What we are asking the community

Please review this proposal and provide us with any feedback you have regarding the boundary nodes. Please also review the other related proposals on trusted execution environments and boundary nodes. We invite you to engage in the discussion and hope it will be fruitful and useful for the IC community and for the future edge framework of the IC.

Developer forum: https://forum.dfinity.org/t/long-term-r-d-decentralized-ca-and-dns-proposal/9669/3



Long Term R&D: Decentralized CA and DNS