2 ms·
I will refrain from begging you to answer the question. It is sufficient to note that every PKI is as secure as its weakest link. If my CA is 512 bit RSA, that
by xorcist 9y ago
I will refrain from begging you to answer the question.
It is sufficient to note that every PKI is as secure as its weakest link. If my CA is 512 bit RSA, that is the security I am going to get.
That public DNSSEC infrastructure is neglected in places is not really controversial or what we're discussing here, but the use of a singular trust root in place of hundreds should not be taken as evidence of incompetence from the protocol designer.
- tptacek 9y agoPlease point to the 512 bit RSA CA that Chrome, Firefox, or Safari trusts.
- xorcist 9y agoThose are public web browsers and not really relevant to the matter here. They do not, as far as I know, implement DANE and if they did they would likely not trust 512-bit RSA certificates either. (Who knows? That might even have been a good way to bootstrap a good policy baseline, had they supported it.)
- tptacek 9y agoI seriously don't understand what you're trying to say at this point.