4 ms·
That would run afoul of DKIM and DNSSEC unless they seize the signing key too. Replacing the latter is particularly hard as DNSSEC operates a separate single t
by AstralStorm 5y ago
That would run afoul of DKIM and DNSSEC unless they seize the signing key too.
Replacing the latter is particularly hard as DNSSEC operates a separate single trust anchor and is not as easy to circumvent silently as say x.509.
- toomuchtodo 5y agoRight, it’s all dependent on how rigorous sending MXs are validating the receiving MX cryptographically and if the gov can obtain keying material (or rekey). The MITM part is fairly trivial for a competent nation state.
- AstralStorm 5y agoEven obtaining valid DNSSEC and x.509 is easy, as DE government has its own trusted key subroot. It is a strong case for using key pinning on all levels, from routing protocols through DNS all the way to email signatures.
- deleted 5y ago[deleted]
- gruez 5y agoIt's possible, but it would have to be a pretty important target because if it gets discovered, the root would get revoked and can't be used for such purposes again.
- AstralStorm 5y agoThat would be a political landmine to revoke a lawfult interception root. You could do that, but there's nothing stopping German government from issuing another. Did you see anyone ban Turkey or China roots?