4 ms·
Hm. I wonder how often this happens. We should be able to detect it easily if they do it all the time. Today they don't have to. For the long term I wonder if
by adamsmith 17y ago
Hm. I wonder how often this happens. We should be able to detect it easily if they do it all the time. Today they don't have to.
For the long term I wonder if it's possible to close this hole by putting certs into DNS and using a single key to sign all of these DNS records. Is this part of the DNSSEC spec? (not at a computer and can't remember for sure if it is called DNSSEC; whatever the name of the next gen DNS is.)
- tptacek 17y agoThe original intent of DNSSEC was to provide an IETF-endorsed public key infrastructure, not to defend the DNS from attacks. The idea was, "we have this great DNS protocol, it works well at Internet-scale, let's leverage it for something other than hostname resolution". The reality of DNSSEC is that it's creaky, somewhat broken, solves neither the PKI nor the DNS protection problem well, and --- because it is likely to pervasively screw up applications across the Internet --- unlikely ever to be deployed. Either way, there's no magic bullet. If you concede root keys to China, you have to concede DNSSEC keys --- which are, if anything, more loosely held and more widely distributed than CA keys, which have never had a known breach.