4 ms·

> It's worth keeping in mind that you can revoke an entire CA > ... but you can't do that with the DNS hierarchy. DANE effectively revokes ALL CAs. Forever.

> It's worth keeping in mind that you can revoke an entire CA > ... but you can't do that with the DNS hierarchy. DANE effectively revokes ALL CAs. Forever. Once again, you are confused about what is the role of TLDs in DANE. They are not equivalent to CAs in WebPKI. In a DANE-based PKI system, TLDs have neither less nor more power than they already have today with the WebPKI system. So there is exactly as much need to revoke them in DANE as there is today with the WebPKI system, which is also susceptible to the exact same attacks from TLDs as the DANE-based PKI system. > It's worth keeping in mind that you can revoke an entire CA --- immensely popular and important CAs have been entirely removed from trust stores, quite recently You can, but browser vendors are reluctant to do it because it would break, potentially, thousands or millions of websites if a single CA gets removed from trust stores. And it would take months or years for that removal to be reflected in millions of deployed systems out there who seldom or never update. In DANE, there are no such problems.

_8j50 4y ago
Are you saying registrars are equivalent to CAs now and they can revoke domains just like they could reclaim them before? Right now, I trust TLDs to tell me the NS of the domain so I can query its IP against that NS, I don't trust them to validate that the true owner of the site currently controls the domain. So under DANE, who else if not TLDs does one ultimately trust to attest to that claim? Honestly asking, I don't know enough about DANE.
- wizeman 4y ago
  > Are you saying registrars are equivalent to CAs now and they can revoke domains just like they could reclaim them before? I'm sorry, I don't understand the question. Could you rephrase it or expand on it? Specifically, I don't understand what "before" is in regards to -- before what? > Right now, I trust TLDs to tell me the NS of the domain so I can query its IP against that NS, I don't trust them to validate that the true owner of the site currently controls the domain. But you trust registrars for that, right? And registrars basically send that information to the TLD and coordinate with the TLD so that they point the NS record to whatever the owner of the domain wants. Either way, yes, both your registrar and your TLD have the same technical ability to attack and perform a man-in-the-middle against your entire domain, either in the current WebPKI system or a DANE-based PKI system. So that is not a problem with DANE any more than it's a problem with the WebPKI system. Of course, what is possible to do technically and what is legal can be entirely different matters. But it is technically possible, and usually illegal in most circumstances (except under judicial order or as a result of law enforcement I suppose), to do these kinds of attacks with both DANE and WebPKI. > So under DANE, who else if not TLDs does one ultimately trust to attest to that claim? Honestly asking, I don't know enough about DANE. Which claim, who is the owner of the site? It would be the same as it is now. As far as I understand, registrars do that and then coordinate with whoever manages the TLD. In fact, that's what I've been saying, the criticism against DANE is equally valid with WebPKI, because the domain system would be the same. Except WebPKI is more fragile and has a lot more weak links in its chain. tptacek says you can't revoke keys in a DANE system. Yes, you can, you can revoke them yourself! You don't need to wait for browser vendors to revoke an entire CA, potentially affecting thousands or millions of other websites. And they may actually decide not to revoke the CA, even if they issued rogue certificates, for several reasons. What browsers can't do in DANE is revoke the TLD's keys (but the TLDs can do it themselves if they were attacked). But of course, it makes no sense to revoke the TLD's keys if they are the attacker. Because if a TLD hijacks your domain (and they already do that today, whenever law enforcement and judges require them to do it), then neither DANE nor WebPKI can do squat about it.
  - tptacek 4y ago
    You have confused discretionary revocation with misissuance.
    - wizeman 4y ago
      > You have confused discretionary revocation with misissuance. Ok, then please enlighten me. What is misissuance in DANE? Because if misissuance in DANE is your TLD hijacking your domain... how does insecure DNS + WebPKI prevent that kind of attack?
tptacek 4y ago
DANE doesn't revoke any CAs. You can read AGL's post about why DANE just adds an nth new CA to the trust store (or, it would: no browser currently plans to adopt DANE; browsers actually removed their DANE code). Meanwhile: it simply is the case that if LetsEncrypt starts misissuing certificates, Google and Mozilla can (and likely will) revoke it. Meanwhile: if the operators of the root zone or any the FVEY TLDs misissue, nobody can revoke them. You could try to argue that this was academic, except that the USG routinely and publicly manipulates the DNS for policy reasons.
- wizeman 4y ago
  > You can read AGL's post about why DANE just adds an nth new CA to the trust store Who's AGL and where is that post? I don't see why it would be like adding a new CA. If the client can do DNSSEC validation then he could just use DANE, bypass the whole WebPKI system and basically distrust all CAs (if the website has already migrated to DANE). It's not the same as adding a new CA, because in that case you are trusting that CA and you are also trusting all other CAs at the same time. > (or, it would: no browser currently plans to adopt DANE; browsers actually removed their DANE code). Yeah, I wonder why they did that. So Firefox adds DNS-over-HTTPS but then it doesn't implement DANE? How does that make any sense? If you're already doing DNS-over-HTTPS then you're basically already at the point where you can get full DANE protection for free. > Meanwhile: it simply is the case that if LetsEncrypt starts misissuing certificates, Google and Mozilla can (and likely will) revoke it. According to their own stats, Let's Encrypt is protecting around 300 million active domains. Which means Google and Mozilla can't revoke Let's Encrypt without breaking the Internet. So don't count on that happening, ever. > Meanwhile: if the operators of the root zone or any the FVEY TLDs misissue, nobody can revoke them. If those operators were attacked, they can revoke themselves. If they are the attacker (like when the government hijacks your website due to e.g. piracy), you are exactly as screwed as you would be with the WebPKI system. > You could try to argue that this was academic, except that the USG routinely and publicly manipulates the DNS for policy reasons. Yes. And how does the WebPKI secure your website when that happens? Answer: it doesn't. You're moving the goal posts and you don't even notice.
  - 4y ago

_8j50 4y ago

Are you saying registrars are equivalent to CAs now and they can revoke domains just like they could reclaim them before? Right now, I trust TLDs to tell me the NS of the domain so I can query its IP against that NS, I don't trust them to validate that the true owner of the site currently controls the domain. So under DANE, who else if not TLDs does one ultimately trust to attest to that claim? Honestly asking, I don't know enough about DANE.

wizeman 4y ago
> Are you saying registrars are equivalent to CAs now and they can revoke domains just like they could reclaim them before? I'm sorry, I don't understand the question. Could you rephrase it or expand on it? Specifically, I don't understand what "before" is in regards to -- before what? > Right now, I trust TLDs to tell me the NS of the domain so I can query its IP against that NS, I don't trust them to validate that the true owner of the site currently controls the domain. But you trust registrars for that, right? And registrars basically send that information to the TLD and coordinate with the TLD so that they point the NS record to whatever the owner of the domain wants. Either way, yes, both your registrar and your TLD have the same technical ability to attack and perform a man-in-the-middle against your entire domain, either in the current WebPKI system or a DANE-based PKI system. So that is not a problem with DANE any more than it's a problem with the WebPKI system. Of course, what is possible to do technically and what is legal can be entirely different matters. But it is technically possible, and usually illegal in most circumstances (except under judicial order or as a result of law enforcement I suppose), to do these kinds of attacks with both DANE and WebPKI. > So under DANE, who else if not TLDs does one ultimately trust to attest to that claim? Honestly asking, I don't know enough about DANE. Which claim, who is the owner of the site? It would be the same as it is now. As far as I understand, registrars do that and then coordinate with whoever manages the TLD. In fact, that's what I've been saying, the criticism against DANE is equally valid with WebPKI, because the domain system would be the same. Except WebPKI is more fragile and has a lot more weak links in its chain. tptacek says you can't revoke keys in a DANE system. Yes, you can, you can revoke them yourself! You don't need to wait for browser vendors to revoke an entire CA, potentially affecting thousands or millions of other websites. And they may actually decide not to revoke the CA, even if they issued rogue certificates, for several reasons. What browsers can't do in DANE is revoke the TLD's keys (but the TLDs can do it themselves if they were attacked). But of course, it makes no sense to revoke the TLD's keys if they are the attacker. Because if a TLD hijacks your domain (and they already do that today, whenever law enforcement and judges require them to do it), then neither DANE nor WebPKI can do squat about it.
- tptacek 4y ago
  You have confused discretionary revocation with misissuance.
  - wizeman 4y ago
    > You have confused discretionary revocation with misissuance. Ok, then please enlighten me. What is misissuance in DANE? Because if misissuance in DANE is your TLD hijacking your domain... how does insecure DNS + WebPKI prevent that kind of attack?

tptacek 4y ago

DANE doesn't revoke any CAs. You can read AGL's post about why DANE just adds an nth new CA to the trust store (or, it would: no browser currently plans to adopt DANE; browsers actually removed their DANE code). Meanwhile: it simply is the case that if LetsEncrypt starts misissuing certificates, Google and Mozilla can (and likely will) revoke it. Meanwhile: if the operators of the root zone or any the FVEY TLDs misissue, nobody can revoke them. You could try to argue that this was academic, except that the USG routinely and publicly manipulates the DNS for policy reasons.

wizeman 4y ago
> You can read AGL's post about why DANE just adds an nth new CA to the trust store Who's AGL and where is that post? I don't see why it would be like adding a new CA. If the client can do DNSSEC validation then he could just use DANE, bypass the whole WebPKI system and basically distrust all CAs (if the website has already migrated to DANE). It's not the same as adding a new CA, because in that case you are trusting that CA and you are also trusting all other CAs at the same time. > (or, it would: no browser currently plans to adopt DANE; browsers actually removed their DANE code). Yeah, I wonder why they did that. So Firefox adds DNS-over-HTTPS but then it doesn't implement DANE? How does that make any sense? If you're already doing DNS-over-HTTPS then you're basically already at the point where you can get full DANE protection for free. > Meanwhile: it simply is the case that if LetsEncrypt starts misissuing certificates, Google and Mozilla can (and likely will) revoke it. According to their own stats, Let's Encrypt is protecting around 300 million active domains. Which means Google and Mozilla can't revoke Let's Encrypt without breaking the Internet. So don't count on that happening, ever. > Meanwhile: if the operators of the root zone or any the FVEY TLDs misissue, nobody can revoke them. If those operators were attacked, they can revoke themselves. If they are the attacker (like when the government hijacks your website due to e.g. piracy), you are exactly as screwed as you would be with the WebPKI system. > You could try to argue that this was academic, except that the USG routinely and publicly manipulates the DNS for policy reasons. Yes. And how does the WebPKI secure your website when that happens? Answer: it doesn't. You're moving the goal posts and you don't even notice.
- 4y ago