3 ms·
Also no one cares about integrity since it is already validated by TLS. And it seems that DNSSEC is not even widely supported by TLDs. My domain says DNSSEC is
by SilverRed 5y ago
Also no one cares about integrity since it is already validated by TLS. And it seems that DNSSEC is not even widely supported by TLDs. My domain says DNSSEC is not available.
Seems like DNSSEC is another failed spec like certificate pinning.
- josephcsible 5y agoWe need DNSSEC for eSNI/ECH to be possible.
- tptacek 5y agoThe eSNI drafts I read say explicitly that DNSSEC is not required (there's a whole section about it), which is good, because if it were, eSNI would be dead in the water.
- josephcsible 5y agoI looked again and you're correct. For other readers, the justification is basically that if an attacker can MITM DNS, then they can find out what domains you're going to even without compromising eSNI/ECH.
- tptacek 5y agoI double checked the RFCs, but I'm not kidding that you can generally work this stuff out axiomatically (for a change) --- if an important new standard requires DNSSEC, it's not an important new standard, because it can't happen. DNSSEC is moribund.