4 ms·
I fully agree that 1024 bit RSA needs to go. Beyond that, if I take the insanely bad track record of CAs as a group, and compare to the (as far as I know) comp
by phicoh 9y ago
I fully agree that 1024 bit RSA needs to go.
Beyond that, if I take the insanely bad track record of CAs as a group, and compare to the (as far as I know) complete lack of serious attacks on DNSSEC (including even those with 1024 bit keys), then I would put my money on DNSSEC+DANE.
For DANE you need to do client side validation. But that has been known for quite a while now. And there is code (for example getdns) to do that.
For e-mail there is the additional complexity that DANE seems to be the only way to transition to SMTP over TLS without downgrade attacks.
- tptacek 9y agoWhy would there have been any attacks on DNSSEC? Literally no real-world system relies on it right now. It's "deployed" on a small subset of large networks, but not in ways where those networks are materially exposed if DNSSEC fails. As for SMTP: the IETF is pursuing STS, which breaks that downgrade attack the same way HSTS does for the web (except far more powerfully, since the most important MTA relationships are far more stable than the web's), with an explicit design goal of not relying on DANE --- which nobody uses.
- phicoh 9y agoPlenty of published attacks are not all that practical. There are plenty of security researchers that would like to have some nice attacks on their CVs. If you like the security of HSTS, then I guess STS is for you. Personally I'd like something better then just blindly trusting the network the first time you try to connect to something.
- tptacek 9y agoSecurity researchers generally do not in fact spend a lot of time attacking systems that nobody uses. But in the sense that you're referring to, BIND, the de facto standard Internet DNS server, has one of the worst records in all of software security.
- xorcist 9y agoYou keep saying that nobody uses it, which isn't true. It's been deployed in the real world for some time now, securing some real systems. The threat model is different than for public CA TLS and not any less secure.
- tptacek 9y agoIf I published the secret key bits for the root KSK on Pastebin, right now, who --- specifically --- would be endangered?
- xorcist 9y agoThe fact that real world public systems such as SSH and SMTP rely on it has led to people relying on it in other protocols as well, where data is transferred between two parties and it is convenient to rely on established infrastructure for key rollovers and distributed trust. It's not a bad idea where the trust model is a little more complex than two parties exchanging keys on a regular schedule. Public implementation leaves a little to be desired, but that doesn't mean the protocol is ill designed.
- tptacek 9y agoCan you actually answer the question I asked?
- xorcist 9y agoI did answer with two specific examples of public protocols that can rely on DNSSEC. The fact that I will not point out specific endpoints where those or similar policies are in use should not be too surprising. Real world people use SSHFP and DANE, and those would stop working if zones suddently didn't validate.
- tptacek 9y agoAll you did was say that there are two protocols that have some kind of DNSSEC integration. That wasn't the question I asked. Lots of things have DNSSEC integrations that nobody relies on. Is the answer to my question "I don't know"?