3 ms·
The crypto is as strong as the weakest link for each domain; if a root or intermediary for my domain is using old crypto, it doesn’t matter what I’m using as th
by akerl_ 7y ago
The crypto is as strong as the weakest link for each domain; if a root or intermediary for my domain is using old crypto, it doesn’t matter what I’m using as the end zone operator.
- alwillis 7y agoRegarding outdated crypto, that’s a common DNSSEC trope that’s been debunked: https://easydns.com/blog/2015/08/06/for-dnssec/#weak https://easydns.com/blog/2015/08/06/for-dnssec/#weak
- tptacek 7y agoNot only has it not been "debunked", but DNSSEC's own proponents openly acknowledge that the DNSSEC hierarchy is littered with 1024-bit RSA keys; see the chain-extension fiasco on the TLS working group mailing list. Or, see the stats you yourself posted to this thread a few days ago, which included key breakdowns. Further, despite the fact that DNSSEC uses outmoded P-curve ECC, and that modern signature schemes aren't even implemented for it, curve usage in DNSSEC is a tiny fraction of all keys. The author of this post is simply wrong; what's more, he was wrong five years ago, and the situation has not improved.