3 ms·

I've used DNSCrypt for some time and think it's great software, however I disagree with the author's position it makes certificate expiration a thing of the pas

by oil25 7y ago

I've used DNSCrypt for some time and think it's great software, however I disagree with the author's position it makes certificate expiration a thing of the past. Setting a short expiry and automation for renewal is optional - and I strongly believe optional security is irrelevant. If certificates have a good reason to expire after 24 hours, or sooner, the software should guarantee it AND provide the automation tooling required to update it. Relying on the user to be informed and act accordingly is not a valid strategy.

jedisct1 7y ago
The specification says that resolvers MUST rotate the short-term key pair every 24 hours at most. This is not optional. Automation tooling to update the certificates is provided. The Docker image that a lot of people use to run servers does this automatically. Keys are rotated every 8 hour. The client software issues warnings, but tolerates certificates having a time-to-live longer than 24 hours. Not all DNS operators have shifted to short-lived certificates yet, so being tolerant is a reasonable thing to do.
- oil25 7y ago
  I don't use Docker; I run dnscrypt-wrapper on my own server and clients connect to it using your dnscrypt-proxy software. Please pardon my ignorance, but how would you propose automating key rotation in this circumstance (assuming the key is "sdns://...")? Right now it's an involved process of interactively logging in weekly to generate the keys and copy-paste the value into the dnscrypt-proxy.toml configuration file - for each client! I'm probably missing something obvious. Thank you for your work and reply.
  - jedisct1 7y ago
    The DNS stamp (the sdns: address that clients use) doesn't have to change. That wouldn't be very practical :) See the documentation of dnscrypt-wrapper: https://github.com/cofyc/dnscrypt-wrapper https://github.com/cofyc/dnscrypt-wrapper Two kind of keys are involved: a long-term key ("provider key", used for signatures), and ephemeral keys (used for encryption, and signed by the long-term key). Clients only need the public long-term key, which is included in the DNS stamp. What you are rotating is just the ephemeral key pair (`--gen-crypt-keypair`). This is similar to what happens to TLS certificates: you can update the certificate for a domain name as frequently as needed. But you don't need to install a new version of the operating system every time somebody adds or changes a certificate for their website. dnscrypt-wrapper can serve multiple certificates simultaneously, so you can serve the next certificate even if the current one hasn't expired yet.

by oil25 7y ago

jedisct1 7y ago

The specification says that resolvers MUST rotate the short-term key pair every 24 hours at most. This is not optional. Automation tooling to update the certificates is provided. The Docker image that a lot of people use to run servers does this automatically. Keys are rotated every 8 hour. The client software issues warnings, but tolerates certificates having a time-to-live longer than 24 hours. Not all DNS operators have shifted to short-lived certificates yet, so being tolerant is a reasonable thing to do.

oil25 7y ago
I don't use Docker; I run dnscrypt-wrapper on my own server and clients connect to it using your dnscrypt-proxy software. Please pardon my ignorance, but how would you propose automating key rotation in this circumstance (assuming the key is "sdns://...")? Right now it's an involved process of interactively logging in weekly to generate the keys and copy-paste the value into the dnscrypt-proxy.toml configuration file - for each client! I'm probably missing something obvious. Thank you for your work and reply.
- jedisct1 7y ago
  The DNS stamp (the sdns: address that clients use) doesn't have to change. That wouldn't be very practical :) See the documentation of dnscrypt-wrapper: https://github.com/cofyc/dnscrypt-wrapper https://github.com/cofyc/dnscrypt-wrapper Two kind of keys are involved: a long-term key ("provider key", used for signatures), and ephemeral keys (used for encryption, and signed by the long-term key). Clients only need the public long-term key, which is included in the DNS stamp. What you are rotating is just the ephemeral key pair (`--gen-crypt-keypair`). This is similar to what happens to TLS certificates: you can update the certificate for a domain name as frequently as needed. But you don't need to install a new version of the operating system every time somebody adds or changes a certificate for their website. dnscrypt-wrapper can serve multiple certificates simultaneously, so you can serve the next certificate even if the current one hasn't expired yet.