[Executable] Replace DNSSEC oracle algorithms
AI summary
This proposal aims to upgrade the ENS DNSSEC oracle by replacing three cryptographic algorithm contracts. The primary motivation is to fix a critical security vulnerability that could allow fraudulent claiming of domain names under .cc and .name TLDs due to a flaw in RSA signature validation. Additionally, it includes an optimization to reduce gas costs for P-256 signature verification by leveraging a new Ethereum precompile.
If this proposal passes, the critical security vulnerability affecting .cc and .name domains will be patched, preventing potential fraudulent registrations. Users interacting with P-256 signatures will benefit from significantly lower gas fees, reducing transaction costs. If it fails, the security vulnerability will persist, leaving .cc and .name domains susceptible to unauthorized claims.
Voting results
🐳 Whale votes
0 votes > 5% VPFull proposal
[Executable] Replace DNSSEC oracle algorithms
Abstract
This proposal replaces three DNSSEC oracle algorithms with newly deployed contracts to address the following two issues:
- feat: Replace EllipticCurve with EIP-7951 P-256 precompile for Algorithm 13
- RSA Signature Forgery via Missing PKCS#1 v1.5 Padding Validation in ENS DNSSEC Oracle
Motivation
RSA Signature Forgery (Critical)
The RSASHA256Algorithm and RSASHA1Algorithm con…