3 ms·
We have had a similar protocol for TOFU on the web for a very long time called HTTP Public Key Pinning, and it did nothing to deprecate PKI. It is a bit telling
by belorn 8y ago
We have had a similar protocol for TOFU on the web for a very long time called HTTP Public Key Pinning, and it did nothing to deprecate PKI. It is a bit telling that google actually removed HTTP Public Key Pinning in 2017 from chrome.
I can't speculate if DNSSEC can continue grow or will fall in use in some unspecified future, but I suspect that a TOFU version of key pinning for email server won't be the death knell. If it work it is because the wast majority of email traffic is located in basically a handful of companies, which is why the wast majority of domain owners won't notice a difference. I would assume Microsoft already pins the certificate of Google servers and vice verse.
- tptacek 8y agoI'm not saying that global key continuity schemes always work, only that they have worked (SSH is the best-known example), where global PKI schemes have never once worked. Late edit: But note: Google didn't follow up the deprecation of HPKP by promoting DANE. Rather: CT is working, and given that, HPKP wasn't worth the hassle. CT doesn't depend on DNSSEC either!