3 ms·
With the CT system I can monitor the CA's issuance, with DNSSEC I can't retroactively monitor if someone has changed the DANE keys and intercepted traffic.
by Avamander 6y ago
With the CT system I can monitor the CA's issuance, with DNSSEC I can't retroactively monitor if someone has changed the DANE keys and intercepted traffic.
- dane-pgp 6y agoTrue, DNSSEC Transparency is not as developed a technology as Certificate Transparency. There has been experimental deployment of such a system[0] but to give higher assurance there is a small addition to the DNS data that needs to be adopted first[1], which is still going through the IETF process. [0] https://twitter.com/ln4711/status/754516056878772224 https://twitter.com/ln4711/status/754516056878772224 [1] https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-delegation-only-00 https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-deleg...
- tptacek 6y agoCertificate Transparency, by contrast, exists.
- dane-pgp 6y agoThere was a time when Certificate Transparency didn't exist, and people didn't propose throwing away the web PKI because of that.
- Avamander 6y agoYeah, because Web PKI existed, DNSSEC has yet to gather any meaningful good deployment. It's not hard to throw away something that doesn't exist :P