3 ms·
Just to clarify, bluejekyll referred to the root keys as a "somewhat weak RSA key", you pointed out that the root keys are 2048 bit, and tptacek responded point
by akerl_ 8y ago
Just to clarify, bluejekyll referred to the root keys as a "somewhat weak RSA key", you pointed out that the root keys are 2048 bit, and tptacek responded pointing out that while the root keys are 2048 bit, the chain between them and basically any site with DNSSEC has 1024 bit keys involved.
That's not really "moving the goalpost", so much as "a conversation involving more than 2 people".
I pulled up the chain for cloudflare.com on the grounds that they'd care more than the average site about DNSSEC, and here was the result: http://dnsviz.net/d/cloudflare.com/dnssec/ http://dnsviz.net/d/cloudflare.com/dnssec/
So that's a 2048 bit root, and then as the chain passes through .com there's a 1024 bit RSA key, and then they have ECC keys for their zone. If their TLS cert had a hop in the chain that used MD5 hashes, Chrome would be refusing to trust their site.
- teddyh 8y agoFirstly, now that the root has a 2048 bit key, I predict that the rest of the TLDs will follow soonish. Previously, the concept was unproven, but now that it has been proven to work, I assume that keys will be rolled and progress will be made. Secondly, as I understand it, a 1024-bit RSA key, while not recommended, is still vastly more secure than an MD5 hash.
- tptacek 8y agoPeople have been predicting that since before Adam Langley wrote "Why Not Dane In Browsers", and making excuses about the keys that are there. Nobody denies that a 1024 bit RSA key is less bad than an MD5 certificate; it's still quite bad, and, personally, I'd argue, the worst kind of bad --- the kind of flaw that motivates large capital and operational expenditures at intelligence agencies.
- belorn 8y agoAre you saying that with the right amount of budget a 1024 RSA key can be broken today?
- tptacek 8y agoYes, of course I am. I'd be repeating something Eran Tromer said 10 years ago.
- deleted 8y ago[deleted]
- teddyh 8y agoEven if every key below the root were 1024 bits, why would this be an argument against the concept of DNSSEC in general? DNSSEC keys can, by design, be rolled and replaced, and people will replace them as soon as they feel it is reasonably safe to do so. The perfect is the enemy of the good. What is the intended result of advocating for choosing not to adopt DNSSEC? Is this intended result actually likely, or is it more like a boycott for the principle of the thing?
- tptacek 8y agoI don't think I can answer this any more effectively than I did in "Against DNSSEC", linked upthread. I'll just point out that the bad is also the enemy of the good.
- akerl_ 8y agoOn the first point: quite a few DNSSEC records use ECC keys, and have for a while. If your hypothesis holds, why not switch the root 2048 bit RSA keys, and those TLD-level 1024 bit keys, for ECC keys? On the second: MD5 is one example, but the browser blacklists SHA1 as well. It also blacklists CAs that behaved poorly in the past, and refuses to use vulnerable ciphers.
- teddyh 8y ago> why not switch the root 2048 bit RSA keys, and those TLD-level 1024 bit keys, for ECC keys? Because this is the first time they ever switched the root key, and they want to observe the effects a bit more first? My prediction assumes that it works and sufficient time will pass. Also, ECC keys are not yet as widely supported by resolvers as RSA keys are. This, too, will require experimentations and time for conversion to be viable.
- tptacek 8y agoYou're conceding a huge problem with DNSSEC. Yes, support for ECC isn't great. Either RIPE or APNIC was tracking it and last I saw something like 1/3 of the deployed base can't handle it, meaning effectively that everyone is stuck with the lowest common denominator of RSA and ECDSA. Meanwhile: the p-curve ECDSA that we're talking about seeing deployed is already very outmoded. And, unlike RSA PKCS1v15 signatures, where the concerns are theoretical and not practical, P-curve ECDSA is practically problematic. It could take a decade to get to the 2018 standard for curve security (presumably, a Schnorr-like construction on a curve like 25519). Meanwhile: nobody relies on DNSSEC today. I'm not kidding when I say the root keys could land on Pastebin tonight and almost nobody would have to work late or even get paged. Doesn't it seem just sort of plainly obvious that we should drop a flag on the broken protocol we're looking at now and re-do it properly with modern cryptography?
- deleted 8y ago[deleted]
- teddyh 8y ago