4 ms·

A sad thing is that, on its face, this isn’t actually crazy: > At the top of my list of concerns is that browser and client vendors (Root Store Operators) will

by amluto 3y ago

A sad thing is that, on its face, this isn’t actually crazy: > At the top of my list of concerns is that browser and client vendors (Root Store Operators) will have a legal obligation to add Government mandated Root Certificate Authorities to their Root Stores, bypassing existing approval mechanisms. > Yep, you read that right. Government mandated Root Certificate Authorities... > I could end this blog post right here because anyone reading this will understand the significance of such a statement, and just how much of a catastrophically bad idea that is, but it gets worse. At the end of the day, (other than the EV-like “additional attested attributes”, which have been tried and were not a success), this makes quite a bit of sense: the EU is the authority as to the mapping from foobar.eu to whatever logically lives there. Norway is the authority mapping foobar.no. The US likewise controls .us, etc. So, if the EU says that foobar.eu maps to some public key, who is Google or Mozilla or Apple to question it? Of course, all of this is ignoring massive technical issues. DNSSEC really does map domain names to attributes (but not individual names!) in a verifiable manner, and DANE can extend it to HTTPS, but DNSSEC is massively problematic. And the CA / WebPKI system is a baroque mess that is, finally, sort of under control. And the actual leaked text of the proposal does not respect any of what got the CA system under control. I can imagine a situation in which the EU (through its qualified agents) could attest, cryptographically, which CT or its equivalent, that a domain name in .eu maps to a given certificate, and browsers should accept that. Except this is pointless — browsers already accept the equivalent of this. IMO it would be more valuable for the EU to do the converse: require that browsers not accept a .eu certificate without attenuation from the EU. Raise the bar, don’t lower it! The EU absolutely has an interest in preventing a US (or Chinese or whatever) entity from falsely certifying an EU site.

candiddevmike 3y ago
> DNSSEC is massively problematic. Everyone has all of these problems with DNSSEC but no solutions. What's the better alternative? We need a way to verify hostname lookups. DNSSEC does what it says on the tin. DIYing DNSSEC is a pain in the ass, but in 2023 I think the overlap of folks who self host DNS and aren't capable of setting up DNSSEC is quite small. I personally think we missed a great opportunity with DANE to decentralize a lot of things, but DNSSEC FUD got in the way.
- woodruffw 3y ago
  DoT and DoH seem like better alternatives, these days. At least for the “authenticated delivery of DNS records” bit. My understanding is that if DNSSEC were to break nothing would really happen to the public Internet, indicating that it’s not really a load-bearing component.
  - fanf2 3y ago
    DNSSEC would have prevented the recent TLS MITM attack https://news.ycombinator.com/item?id=37955264 https://news.ycombinator.com/item?id=37955264 The security of DV certificates is shaky without DNSSEC.
    - amluto 3y ago
      Authenticated DANE or CAA would have prevented it. FWIW, there is absolutely no reason that authentication for CAA requests needs to have high bandwidth or low latency or even that it would need to be part of the DNS protocol itself or of any sort of query that ordinary clients do. And the web could tolerate a day-long CAA outage with the only obvious side effect being an inability to issue new certificates. Heck, a signed CAA attestation valid for 24 hours that was generated, for each domain that uses it, at most once per day, would allow quite a bit of ability to ride through an outage.
    - tptacek 3y ago
      That TLS MITM attack was government-initiated, and governments control the DNSSEC roots. But either way: you can't say your system is load bearing because if it was actually deployed it would bear load. It has to actually bear the load, not just in theory but in practice. The root DNSSEC keys could land on Pastebin tonight and almost nobody would need to be paged.
- zdw 3y ago
  DNSCurve solves the issues of securing the channel (solves privacy, not authenticity like DNSSEC attempted), unfortunately it wasn't standardized and didn't get wide adoption.
hurryer 3y ago
> The EU absolutely has an interest in preventing a US (or Chinese or whatever) entity from falsely certifying an EU site. EU is varied with all kinds of interests and geopolitical orientations. For example Hungary. Should we let Hungary certify an EU site?
- miohtama 3y ago
  Hungary, Spain and Cyprus are voting for breaking end-to-end encryption. Hungary is run by now already authorian Orban. Spain has a history of spying their political opponents with Pegasus spyware. Yes, we definitely want to give this guys any authority to tap any of our wire traffic. https://www.wired.com/story/europe-break-encryption-leaked-document-csa-law/ https://www.wired.com/story/europe-break-encryption-leaked-d...
- amluto 3y ago
  That's not at all what I said. The EU has a government, and I don't think anyone particularly disputes which government is the EU government. (I suppose one might argue that .tw is a bit different, but that's a whole different discussion, and somehow the DNS root servers know what to return for SOA and NS queries for tw.) I'm saying that I think it really would be reasonable for the EU to require that browser follow a specified mechanism to restrict which certificates are valid for .eu. And it would be reasonable for Hungary to use the same mechanism to restrict .hu. So browsers would only accept a certificate for a .hu domain if it was signed according to standard PKIX and CA/B Forum rules and had whatever standardized attestation was required from .hu.
  - paranoidrobot 3y ago
    If it were that Only *.hu could be signed by a Hungarian-approved CA, then that would be one thing. However the proposed legislation does not, apparently, say this.
notatoad 3y ago
your comment seems to be making the implication that government-mandated roots will be restricted to their own CCTLD. is this true, or will Chrome and firefox be forced to ship a CA that allows Hungary to sign certs for whatever .com they want to?
- agwa 3y ago
  They will not be restricted to their own ccTLD, and browsers will in fact be forced to ship a CA that allows Hungary to sign certs for whatever .com they want to.

by amluto 3y ago

candiddevmike 3y ago

> DNSSEC is massively problematic. Everyone has all of these problems with DNSSEC but no solutions. What's the better alternative? We need a way to verify hostname lookups. DNSSEC does what it says on the tin. DIYing DNSSEC is a pain in the ass, but in 2023 I think the overlap of folks who self host DNS and aren't capable of setting up DNSSEC is quite small. I personally think we missed a great opportunity with DANE to decentralize a lot of things, but DNSSEC FUD got in the way.

woodruffw 3y ago
DoT and DoH seem like better alternatives, these days. At least for the “authenticated delivery of DNS records” bit. My understanding is that if DNSSEC were to break nothing would really happen to the public Internet, indicating that it’s not really a load-bearing component.
- fanf2 3y ago
  DNSSEC would have prevented the recent TLS MITM attack https://news.ycombinator.com/item?id=37955264 https://news.ycombinator.com/item?id=37955264 The security of DV certificates is shaky without DNSSEC.
  - amluto 3y ago
    Authenticated DANE or CAA would have prevented it. FWIW, there is absolutely no reason that authentication for CAA requests needs to have high bandwidth or low latency or even that it would need to be part of the DNS protocol itself or of any sort of query that ordinary clients do. And the web could tolerate a day-long CAA outage with the only obvious side effect being an inability to issue new certificates. Heck, a signed CAA attestation valid for 24 hours that was generated, for each domain that uses it, at most once per day, would allow quite a bit of ability to ride through an outage.
  - tptacek 3y ago
    That TLS MITM attack was government-initiated, and governments control the DNSSEC roots. But either way: you can't say your system is load bearing because if it was actually deployed it would bear load. It has to actually bear the load, not just in theory but in practice. The root DNSSEC keys could land on Pastebin tonight and almost nobody would need to be paged.
zdw 3y ago
DNSCurve solves the issues of securing the channel (solves privacy, not authenticity like DNSSEC attempted), unfortunately it wasn't standardized and didn't get wide adoption.

hurryer 3y ago

> The EU absolutely has an interest in preventing a US (or Chinese or whatever) entity from falsely certifying an EU site. EU is varied with all kinds of interests and geopolitical orientations. For example Hungary. Should we let Hungary certify an EU site?

miohtama 3y ago
Hungary, Spain and Cyprus are voting for breaking end-to-end encryption. Hungary is run by now already authorian Orban. Spain has a history of spying their political opponents with Pegasus spyware. Yes, we definitely want to give this guys any authority to tap any of our wire traffic. https://www.wired.com/story/europe-break-encryption-leaked-document-csa-law/ https://www.wired.com/story/europe-break-encryption-leaked-d...
amluto 3y ago
That's not at all what I said. The EU has a government, and I don't think anyone particularly disputes which government is the EU government. (I suppose one might argue that .tw is a bit different, but that's a whole different discussion, and somehow the DNS root servers know what to return for SOA and NS queries for tw.) I'm saying that I think it really would be reasonable for the EU to require that browser follow a specified mechanism to restrict which certificates are valid for .eu. And it would be reasonable for Hungary to use the same mechanism to restrict .hu. So browsers would only accept a certificate for a .hu domain if it was signed according to standard PKIX and CA/B Forum rules and had whatever standardized attestation was required from .hu.
- paranoidrobot 3y ago
  If it were that Only *.hu could be signed by a Hungarian-approved CA, then that would be one thing. However the proposed legislation does not, apparently, say this.

notatoad 3y ago

your comment seems to be making the implication that government-mandated roots will be restricted to their own CCTLD. is this true, or will Chrome and firefox be forced to ship a CA that allows Hungary to sign certs for whatever .com they want to?

agwa 3y ago
They will not be restricted to their own ccTLD, and browsers will in fact be forced to ship a CA that allows Hungary to sign certs for whatever .com they want to.