3 ms·
CloudFlare DNSSEC uses ECDSA on P256 and SHA256 exclusively. That's what modern TLS uses. https://blog.cloudflare.com/dnssec-done-right/ https://blog.cloudflar
by FiloSottile 11y ago
CloudFlare DNSSEC uses ECDSA on P256 and SHA256 exclusively. That's what modern TLS uses.
https://blog.cloudflare.com/dnssec-done-right/ https://blog.cloudflare.com/dnssec-done-right/
- tptacek 11y agoThat's what current TLS uses. Modern TLS, Google TLS, uses better crypto than that. In particular, as you know, ECDSA is outmoded. Also: Cloudflare may use ECDSA, but the roots and TLDs do not. And because DNSSEC is a stupid design, it matters a lot that they don't.
- sarciszewski 11y agoHaha Filo did you really call ECDSA modern?
- FiloSottile 11y agoYeah. That's the best thing you can get for TLS certificates now, and most likely for the next five years. So that's what modern TLS uses, yeah. I hate it as much as the next cryptographer, and I actually gave talks begging people to at least do deterministic ECDSA. But there's no EdDSA on the horizon. Also, I think Thomas in the sister comment was referring to handshakes, but I was talking about X509.
- sarciszewski 11y agoFair enough. I'm still hoping we'll see EdDSA (22519 and 448) sooner rather than later. :)