3 ms·
I did answer with two specific examples of public protocols that can rely on DNSSEC. The fact that I will not point out specific endpoints where those or simila
by xorcist 9y ago
I did answer with two specific examples of public protocols that can rely on DNSSEC. The fact that I will not point out specific endpoints where those or similar policies are in use should not be too surprising. Real world people use SSHFP and DANE, and those would stop working if zones suddently didn't validate.
- tptacek 9y agoAll you did was say that there are two protocols that have some kind of DNSSEC integration. That wasn't the question I asked. Lots of things have DNSSEC integrations that nobody relies on. Is the answer to my question "I don't know"?
- xorcist 9y agoNo, it is not. I don't understand why you are so confrontative. The answer is that at the very least those who rely on SSHFP and DANE will rely on DNSSEC. There are also proprietary protocols which have chosen to rely on it. Unless your real argument is that no one has ever used that in production, anywhere, that should be plenty by way of example.
- tptacek 9y agoMost (maybe all?) people who use SSHFP would be no worse off were SSHFP to suddenly stop working, since SSH relies on key continuity, and the introduction-connection security risk is one that virtually everyone who uses SSH already mitigates manually. So, no, you have not actually established that anyone would be endangered were the root KSK private bits published on Pastebin. I suspect, in all seriousness, that the answer to my question is "in reality, nobody would be endangered".
- xorcist 9y agoOpenSSH does not rely on key continuity when used with SSHFP, it will not store key data at all since that would make the whole endeavour rather useless. Neither does Postfix when used with DANE, for example.