3 ms·
The current certificate infrastructure already sits on top of DNS. If an attacker can control your DNS then they can get any CA to issue certificates to them be
by agl 16y ago
The current certificate infrastructure already sits on top of DNS. If an attacker can control your DNS then they can get any CA to issue certificates to them because they can accept emails at that domain.
- CWuestefeld 16y agoYes, of course. What I'm wondering about is if (and how) the proposed DNSSEC infrastructure would be superior in this regard.
- tptacek 16y agoThe current certificate infrastructure does not intrinsically depend on DNS. No scheme is resilient against bad actors at the top of the hierarchy; yes, there are (bad) CAs who offer only DNS-equivalent security today. But that's not an SSL/TLS problem; it's a "we should delete CA certs for those CAs" problem.
- CWuestefeld 16y agoWell, to the extent that a cert enables the browser to compare the site's name to its IP address, it is dependent on DNS.