DNSSEC / NOW REQUIRES CUDA
I fixed DNSSEC by adding an NVIDIA dependency.
I moved DNSSEC zone signing onto an NVIDIA L4 and checked every signature against the CPU and BIND. It got faster.
Earlier work: GPU-accelerated NSEC3 (2016).
Same zone. Same signatures.
Loading recorded resultRecorded benchmark. No GPU is running behind this page.
on this workload, on this machine
Timing breakdown and smaller batches
Total time covers reading the unsigned zone, canonicalizing and hashing records, signing, and writing the signed zone. GPU times include transfers and the CPU work around them. Key generation, warmup and verification are excluded. All batch measurements · Machine and compiler details.
CHECK THE WORK
Your browser can verify one.
A real record set from the measured run, signed on the GPU. WebCrypto checks the RSA signature locally. Change one byte and it fails.
Loading signed record…
The public key is included. The private key is not.
This checks an archived signature over saved bytes. It says nothing about live DNS or whether the signature is still inside its validity window. Download the record, signed bytes and public key.
What this fixes
- Signing this zone
- Measured results are loading.
- The trust model
- No change.
- Key rollovers
- Still your problem.
- Twenty years of arguments
- Now with a CUDA dependency.
Prompted by this DNSSEC discussion and Thomas H. Ptáček’s reply. It settles nothing.
Benchmark code. Don’t sign anything real with it. The GPU path uses variable-time CGBN arithmetic and no RSA blinding. OpenSSL’s CPU path has protections this prototype lacks, so these are not equally hardened signers.
Zones are signed before anyone queries them. This won’t make a single DNS lookup faster, and it says nothing about ECDSA or Ed25519.
Bring your own GPU.
The script builds a test zone, signs it both ways, compares the output byte for byte and runs BIND’s verifier.
git clone https://github.com/quinnypig/dnssec-gpu cd dnssec-gpu ./scripts/reproduce.shCode, requirements and methodology ↗