3 ms·
No, it is not. I don't understand why you are so confrontative. The answer is that at the very least those who rely on SSHFP and DANE will rely on DNSSEC. There
by xorcist 9y ago
No, it is not. I don't understand why you are so confrontative. The answer is that at the very least those who rely on SSHFP and DANE will rely on DNSSEC. There are also proprietary protocols which have chosen to rely on it.
Unless your real argument is that no one has ever used that in production, anywhere, that should be plenty by way of example.
- tptacek 9y agoMost (maybe all?) people who use SSHFP would be no worse off were SSHFP to suddenly stop working, since SSH relies on key continuity, and the introduction-connection security risk is one that virtually everyone who uses SSH already mitigates manually. So, no, you have not actually established that anyone would be endangered were the root KSK private bits published on Pastebin. I suspect, in all seriousness, that the answer to my question is "in reality, nobody would be endangered".
- xorcist 9y agoOpenSSH does not rely on key continuity when used with SSHFP, it will not store key data at all since that would make the whole endeavour rather useless. Neither does Postfix when used with DANE, for example.