3 ms·
Ah, that makes sense. Sorry for the confusion I created. I meant that DNSSEC PKI is wrong in the sense that it is hierarchical, and the root keys are centrally
by oconnore 11y ago
Ah, that makes sense. Sorry for the confusion I created. I meant that DNSSEC PKI is wrong in the sense that it is hierarchical, and the root keys are centrally controlled by a biased party. A better PKI would probably look like Convergence [1], where trust is derived from a hybrid CA/"web of trust" system formed by a network of notaries.
The delegation implemented in DNSSEC is a good thing. I didn't think about how that feature would quite reasonably be lumped in with "PKI".
Oops.
[1]: http://convergence.io/ http://convergence.io/
- indolering 11y agoMarlinspike abandoned convergence a year after it was debuted. It's currently broken on most (all?) platforms. As covered in the article, Convergence-style triangulation of cryptographic information is application/protocol neutral. Indeed, a DNS-level implementation would be much more powerful than what can be accomplished with HTTPS.
- tptacek 11y agoHe moved from Convergence to TACK, which is on hold during the rollout of HPKP, which is like 80% of the value proposition of TACK.
- cpach 11y agoWhat’s in the missing 20%?
- indolering 11y agoIt's still vulnerable to MITM attacks on the first connection.
- cpach 11y agoAh. What is TACK’s proposal to prevent that from happening?