4 ms·

Why are you so focused on "all of .COM's TLS keys" when, under the current CA system, all TLS keys for all domains go straight to NSA and any government that co

Why are you so focused on "all of .COM's TLS keys" when, under the current CA system, all TLS keys for all domains go straight to NSA and any government that controls a CA (e.g. Turkey and China, etc.)? A situation where people can avoid the governments they don't trust is strictly better than this, but you seem to be arguing that it is strictly worse.

tptacek 10y ago
Because: (a) They do not (go ahead and try to get a Google Mail cert). (b) They need not (CA's can be --- and have been --- and will probably within a few weeks be again --- untrusted by browsers) (c) It is insane --- as in, "definition of insanity" insane --- to double down on a hierarchical PKI controlled by governments as a response to problems with the CA system. It is literally the opposite of the direction we should (and are!) going in. I note: in no exchange we have ever had about this issue have you ever so much as rebutted my contention that adopting DNSSEC+DANE would escrow .COM TLS keys with the US government. That's unsurprising, because my contention is true. But I'd like to point it out anyways.
- dane-pgp 10y ago
  (a) The fact that I can't (or won't) get a fake cert for Google Mail doesn't really prove anything. I am not the NSA. I assume you wouldn't accept the challenge if I asked you to produce a fake (but cryptographically valid) DNSSEC response for mail.google.com. (b) Waiting a few months after an attack for a CA to be shut down is not as much comfort as being able to choose in advance which ccTLD or gTLD you are under. As I keep saying, with DNSSEC, the malfeasance of a third party trust source has no effect on your security, unlike the existing case with CAs. (c) Switching from a "chain is as strong as its weakest link" model to one where you can be free from any subset of governments you choose is a strict improvement and very much the right direction to be going in. In response to your note: you have made many claims on this site, and I have rebutted those made in discussions I have been involved in, but I don't remember you making the "escrow" claim in one of the discussions I was involved in. I do remember seeing it recently, though, and laughing to myself about it, trying to work out what was going through your mind when you made that claim. Eventually I realised that by "escrow" you mean "The US government could force Verisign to issue a fake DNSSEC response for a website under .COM", i.e. a situation which is strictly better than "The US government could force Verisign to issue a fake TLS certificate for any website with any domain name." Presumably you would call that key escrow too. I hope I have understood you correctly, and that this counts as a rebuttal, but it's 03:30 here so I'll have to leave this interesting discussion for the night. I look forward to hearing what you have to say in this or another thread soon.
  - tptacek 10y ago
    In a DANE world, every TLS certificate for a site under .COM is validated through the DNS, and the USG, which controls the DNS for .COM, can silently swap in its own identity for that of any of those sites. They don't get the bits of your private key exponent. They don't need them; the DNSSEC key escrow system is subtle enough to let people think their secret keys matter.
    - dane-pgp 10y ago
      In a CA world, every TLS certificate for a site under . is validated through trusting the CA, and the USG, which controls various CAs capable of issuing certificates for any site, can silently swap in its own identity for that of any of those sites. They don't get the bits of your private key exponent. They don't need them; the CA key escrow system is subtle enough to let people think their secret keys matter.
      - tptacek 10y ago
        And? The CA system is already deployed. DNSSEC is not. Why would we deploy another compromised PKI, one that can't be separated from governments, one that would force most huge sites to abandon their current domains to avoid USG spying, when we could spend a fraction of that energy getting CT deployed?
        dane-pgp 10y ago
        I readily accept that we need Certificate Transparency deployed, not least to deter malfeasance in the DNS (which is a more tractable problem as the list of TLDs is relatively small and well known in advance). Hopefully you also accept that DNSSEC (or something very similar to it) is needed to ensure the integrity of DNS responses (and to give us authenticated denial of existence, and so on). The question then becomes "Is the amount of work to use DANE on top of DNSSEC (and potentially changing the TLD of my domains, depending on my threat model) too great to justify the extra security of being insulated from malfeasance by unrelated third parties (i.e. any of the CAs in the world)?" I think that reasonable people can disagree about both the amount of work and the amount of extra security, and it is probably a different balance for each domain being considered. I don't think it is reasonable, though, to say that DANE as a technology shouldn't exist and be available to people who would benefit from it.

tptacek 10y ago

Because: (a) They do not (go ahead and try to get a Google Mail cert). (b) They need not (CA's can be --- and have been --- and will probably within a few weeks be again --- untrusted by browsers) (c) It is insane --- as in, "definition of insanity" insane --- to double down on a hierarchical PKI controlled by governments as a response to problems with the CA system. It is literally the opposite of the direction we should (and are!) going in. I note: in no exchange we have ever had about this issue have you ever so much as rebutted my contention that adopting DNSSEC+DANE would escrow .COM TLS keys with the US government. That's unsurprising, because my contention is true. But I'd like to point it out anyways.

dane-pgp 10y ago
(a) The fact that I can't (or won't) get a fake cert for Google Mail doesn't really prove anything. I am not the NSA. I assume you wouldn't accept the challenge if I asked you to produce a fake (but cryptographically valid) DNSSEC response for mail.google.com. (b) Waiting a few months after an attack for a CA to be shut down is not as much comfort as being able to choose in advance which ccTLD or gTLD you are under. As I keep saying, with DNSSEC, the malfeasance of a third party trust source has no effect on your security, unlike the existing case with CAs. (c) Switching from a "chain is as strong as its weakest link" model to one where you can be free from any subset of governments you choose is a strict improvement and very much the right direction to be going in. In response to your note: you have made many claims on this site, and I have rebutted those made in discussions I have been involved in, but I don't remember you making the "escrow" claim in one of the discussions I was involved in. I do remember seeing it recently, though, and laughing to myself about it, trying to work out what was going through your mind when you made that claim. Eventually I realised that by "escrow" you mean "The US government could force Verisign to issue a fake DNSSEC response for a website under .COM", i.e. a situation which is strictly better than "The US government could force Verisign to issue a fake TLS certificate for any website with any domain name." Presumably you would call that key escrow too. I hope I have understood you correctly, and that this counts as a rebuttal, but it's 03:30 here so I'll have to leave this interesting discussion for the night. I look forward to hearing what you have to say in this or another thread soon.
- tptacek 10y ago
  In a DANE world, every TLS certificate for a site under .COM is validated through the DNS, and the USG, which controls the DNS for .COM, can silently swap in its own identity for that of any of those sites. They don't get the bits of your private key exponent. They don't need them; the DNSSEC key escrow system is subtle enough to let people think their secret keys matter.
  - dane-pgp 10y ago
    In a CA world, every TLS certificate for a site under . is validated through trusting the CA, and the USG, which controls various CAs capable of issuing certificates for any site, can silently swap in its own identity for that of any of those sites. They don't get the bits of your private key exponent. They don't need them; the CA key escrow system is subtle enough to let people think their secret keys matter.
    - tptacek 10y ago
      And? The CA system is already deployed. DNSSEC is not. Why would we deploy another compromised PKI, one that can't be separated from governments, one that would force most huge sites to abandon their current domains to avoid USG spying, when we could spend a fraction of that energy getting CT deployed?
      - dane-pgp 10y ago
        I readily accept that we need Certificate Transparency deployed, not least to deter malfeasance in the DNS (which is a more tractable problem as the list of TLDs is relatively small and well known in advance). Hopefully you also accept that DNSSEC (or something very similar to it) is needed to ensure the integrity of DNS responses (and to give us authenticated denial of existence, and so on). The question then becomes "Is the amount of work to use DANE on top of DNSSEC (and potentially changing the TLD of my domains, depending on my threat model) too great to justify the extra security of being insulated from malfeasance by unrelated third parties (i.e. any of the CAs in the world)?" I think that reasonable people can disagree about both the amount of work and the amount of extra security, and it is probably a different balance for each domain being considered. I don't think it is reasonable, though, to say that DANE as a technology shouldn't exist and be available to people who would benefit from it.