3 ms·
You can check that a new certificate was issued for your domain through Certificate Transparency. Maybe if DANE/TLSA certs would also have be submitted to CT lo
by hdhzy 10y ago
You can check that a new certificate was issued for your domain through Certificate Transparency. Maybe if DANE/TLSA certs would also have be submitted to CT logs and browsers required CT that'd provide stronger security that we have now...
Another thing is DNSSEC's reliance on RSA 1024 (did that change?).
- deleted 10y ago[deleted]
- okket 10y agoYou can absolutely use better keys than RSA 1024 for DNSSEC, see http://dnsviz.net/d/sys4.de/dnssec/ http://dnsviz.net/d/sys4.de/dnssec/ It will take a while until everyone has upgraded, but so far no fast attack on RSA 1024 has been reported... Even elliptic curve algorithm based keys are possible now (and recommended because of their small size, which is good for one packet UDP answers, which is not possible with RSA 2048) See ALG13 etc: https://www.iana.org/assignments/dns-sec-alg-numbers/dns-sec-alg-numbers.xhtml https://www.iana.org/assignments/dns-sec-alg-numbers/dns-sec...
- pfg 10y agoOther problems with DNSSEC aside, the crazy thing here is the suggestion to replace the Web PKI with a system that has taken longer to migrate towards safe key sizes than the existing solution. 1024-bit keys for end-entity certificates were deprecated in 2013 and the last 1024-bit roots were pulled in 2014-2015 (ish?). I don't feel like the CA/B Forum is a particularly fast-moving body, so this is pretty telling.