4 ms·

More attention needs to be paid to QName minimization, IMO. DNSSEC is the only truly hierarchical PKI with pervasive name constraints that we have. That makes

More attention needs to be paid to QName minimization, IMO. DNSSEC is the only truly hierarchical PKI with pervasive name constraints that we have. That makes it very valuable, even if it is difficult to leverage to solve other problems. Like all PKIs, DNSSEC is vulnerable to authorities (that is, authoritative servers) acting as MITMs. WebPKI makes it very easy for nation states to acquire MITM credentials: just subvert a national CA and you're done because the WebPKI lacks name constraints. A real PKI makes this harder, because a nation state can only legally subvert authorities within its jurisdiction. The root zone is special though, as long as there is only one, and that's why the root zone operators make such a special show of key signing events: to increase confidence that it has not been subverted. But the root zone is still a concern -- if not today, then tomorrow. Enter QName minimization. By sending minimized queries -at the cost of having to do more queries, thus having higher latency- one can keep intermediate authorities from observing the full domainname that one is attempting to resolve. That makes is more difficult for authorities to MITM specific targets.

tptacek 7y ago
The opposite claim is closer to the truth regarding "true hierarchical PKIs" versus the WebPKI. In reality, if a state suborns a CA to misissue certificates, Mozilla and Chromium will nuke that CA from orbit. You don't have to wonder about this; Mozilla and Chromium casually destroyed some of the largest commercial CAs. Moreover, misissuance is very likely to be detected, because Chromium and Mozilla have moved towards requiring Certificate Transparency participation. On the other hand, if a state suborns its DNS providers to inject bogus keys, there is no recourse. You can't revoke .COM. Is Google going to become Google.IO? Wait, no, .IO is controlled by Five Eyes as well.
- cryptonector 7y ago
  I don't buy that. First, we see that China, for example, has enormous market power that it uses to get its way in just about every controversy. Second, CAs will get kicked off the TA list only if they get caught.
  - tptacek 7y ago
    I addressed that in my comment: it's never been easier to get caught, since certificate issuance is now cryptographically logged.
- GordonS 7y ago
  > Mozilla and Chromium casually destroyed some of the largest commercial CAs While I agree with much of your comment, I think you are doing both Google and Mozilla a disservice to say they did this "casually". The decisions to distrust the CAs in question were not taken lightly; they came after repeat offences, and the grounds for doing so were abundantly clear.
- silotis 7y ago
  It's also possible for a state to suborn a registrar to publish a fraudulent record so that the state can get a DV cert issued by the CA of its choosing. This leaves the WebPKI in no better shape than DNSSEC + CT when it comes to state level attackers obtaining fraudulent certifications.
  - tialaramex 7y ago
    This is of course why DNSSEC is crucial anyway. DNS is the foundation under the Web PKI, a secure Web PKI on top of insecure DNS doesn't buy you very much. It's impressive we've got this far in fact. It was most fun in the old days, before the Ten Blessed Methods. You'd get this contrast between the wild imaginations of anti-DNSSEC people who imagined every certificate application is investigated by some combination of Jason Bourne and Sherlock Holmes - and a reality where it's just somebody got a blurry fax from a law firm in another country and so they pressed OK because everybody knows lawyers are honest.
    - tptacek 7y ago
      I don't know what you're on about with this "Sherlock Holmes" stuff, but the last several CA kill-shots occurred after Google and Mozilla detected misissuances. And Google and Mozilla didn't just revoke the certificates: they killed the CAs themselves. Are you not watching CT logs for domains you work on?
      - tialaramex 7y ago
        As you definitely ought to know if you had any idea about this topic I run a complete Log Monitor for my employer these days and so in that sense I am watching all of the public logs. I also run smaller monitors and auditors for my own interest as an active participant in m.d.s.policy. Which is why it's always weird to hear your version of what goes on there, since you don't participate and seem to base your understanding on something like a tabloid newspaper report or a Hollywood script rather than the reality.
        7y ago

tptacek 7y ago

The opposite claim is closer to the truth regarding "true hierarchical PKIs" versus the WebPKI. In reality, if a state suborns a CA to misissue certificates, Mozilla and Chromium will nuke that CA from orbit. You don't have to wonder about this; Mozilla and Chromium casually destroyed some of the largest commercial CAs. Moreover, misissuance is very likely to be detected, because Chromium and Mozilla have moved towards requiring Certificate Transparency participation. On the other hand, if a state suborns its DNS providers to inject bogus keys, there is no recourse. You can't revoke .COM. Is Google going to become Google.IO? Wait, no, .IO is controlled by Five Eyes as well.

cryptonector 7y ago
I don't buy that. First, we see that China, for example, has enormous market power that it uses to get its way in just about every controversy. Second, CAs will get kicked off the TA list only if they get caught.
- tptacek 7y ago
  I addressed that in my comment: it's never been easier to get caught, since certificate issuance is now cryptographically logged.
GordonS 7y ago
> Mozilla and Chromium casually destroyed some of the largest commercial CAs While I agree with much of your comment, I think you are doing both Google and Mozilla a disservice to say they did this "casually". The decisions to distrust the CAs in question were not taken lightly; they came after repeat offences, and the grounds for doing so were abundantly clear.
silotis 7y ago
It's also possible for a state to suborn a registrar to publish a fraudulent record so that the state can get a DV cert issued by the CA of its choosing. This leaves the WebPKI in no better shape than DNSSEC + CT when it comes to state level attackers obtaining fraudulent certifications.
- tialaramex 7y ago
  This is of course why DNSSEC is crucial anyway. DNS is the foundation under the Web PKI, a secure Web PKI on top of insecure DNS doesn't buy you very much. It's impressive we've got this far in fact. It was most fun in the old days, before the Ten Blessed Methods. You'd get this contrast between the wild imaginations of anti-DNSSEC people who imagined every certificate application is investigated by some combination of Jason Bourne and Sherlock Holmes - and a reality where it's just somebody got a blurry fax from a law firm in another country and so they pressed OK because everybody knows lawyers are honest.
  - tptacek 7y ago
    I don't know what you're on about with this "Sherlock Holmes" stuff, but the last several CA kill-shots occurred after Google and Mozilla detected misissuances. And Google and Mozilla didn't just revoke the certificates: they killed the CAs themselves. Are you not watching CT logs for domains you work on?
    - tialaramex 7y ago
      As you definitely ought to know if you had any idea about this topic I run a complete Log Monitor for my employer these days and so in that sense I am watching all of the public logs. I also run smaller monitors and auditors for my own interest as an active participant in m.d.s.policy. Which is why it's always weird to hear your version of what goes on there, since you don't participate and seem to base your understanding on something like a tabloid newspaper report or a Hollywood script rather than the reality.
      - 7y ago