4 ms·
DNSSEC is not a good PKI, that's why. There are basically no rules on how to properly operate it, even if there were, there'd be no way to enforce them. There'
by Avamander 2y ago
DNSSEC is not a good PKI, that's why.
There are basically no rules on how to properly operate it, even if there were, there'd be no way to enforce them. There's also almost zero chance a leaked key would ever be detected.
- perching_aix 2y agoI'm not sure I follow, could you please elaborate a bit more? I'm not really suggesting DNS to be exclusively used for PKI over the current Web PKI system of public CAs either.
- bawolff 2y agoThat is kind of the value proposition for DANE though.
- perching_aix 2y agoWhat prevents me from putting the hash of the public key of my public CA certificate into the TLSA record? Nothing. What prevents clients from checking both that the public CA based certificate I'm showing is valid and is present on CT, as well as that it's hashes to the same value I have placed into the TLSA record? Also nothing. Am I grossly misunderstanding something here? Feels like I missed a meta.
- bawolff 2y agoNothing saying you can't, just when people talk about DANE that is usually not what they are proposing. In terms of what you are saying, i think the main objection would be that HPKP feels a lot easier then putting it in DNS and we couldnt even get that to work. Otoh maybe dns could do a lot lower ttl which would counter some of the risks.
- Avamander 2y agoWhat benefit would that provide? It's just one more thing that has to be constantly maintained and could break while providing very little additional security.