3 ms·

Sure but the web is already TOFU even with CAs because the only thing being asserted is that your connected to someone who (probably) controls the domain. The

by Spivak 2y ago

Sure but the web is already TOFU even with CAs because the only thing being asserted is that your connected to someone who (probably) controls the domain. The client is perfectly able to verify that when connecting without a central authority by querying a well-known DNS entry. Literally do what the CA does to check but JIT. This does leave you vulnerable to a malicious DNS server but this isn't an impossible hurdle without re-inventing CAs. With major companies rolling out DoH all you care about is that your DNS server isn't lying to you. With nothing other than dnsmasq you can be your own trusted authority no 3rd party required.

lxgr 2y ago
The web PKI is not TOFU in any way: Neither do most browsers offer a convenient way of persistently trusting a non-PKI-chaining server certificate across multiple site visits, nor do they offer a way to not trust a PKI-chaining certificate automatically. The essence of TOFU is that each party initiating a connection individually makes a trust decision, and these decisions are not delegated/federated out. PKI does delegate that decision to CAs, and them using an automated process does not make the entire system TOFU. Yes, clients could be doing all kinds of different things such as DANE and DNSSEC, SSH-like TOFU etc., but they aren't, and the purpose of a system is what it does (or, in this case, doesn't).
- Spivak 2y ago
  Web PKI is not TOFU in the specific instance where you have an a priori trusted url you know about. But I, and others, argue that this isn't actually that strong of a guarantee in practice. I'm just trusting that this URL is the real life entity I think it is. The only thing you get is that you're connected to someone who has control of the domain. And it's pretty clear that with ACME and DNS challenges we don't need a huge centralized system to do this much weaker thing, you just need any DNS server you trust, it can even be yours.
  - lxgr 2y ago
    > The only thing you get is that you're connected to someone who has control of the domain. Yes, that's the entire scope of the web PKI, and with the exception of EV certificates it never was anything else. > it's pretty clear that with ACME and DNS challenges we don't need a huge centralized system to do this much weaker thing Agreed – what we are doing today is primarily a result of the historical evolution of the system. "Why don't we just trust the DNS/domain registry system outright if we effectively defer most trust decisions to it anyway" is a valid question to ask, with some good counterpoints (one being that the PKI + CT make every single compromise globally visible, while DANE does not, at least not without further extensions). My objection is purely on terminology: Neither the current web PKI nor any hypothetical DANE-based future would be TOFU. Both delegate trust to some more or less centralized entity.

by Spivak 2y ago

lxgr 2y ago

The web PKI is not TOFU in any way: Neither do most browsers offer a convenient way of persistently trusting a non-PKI-chaining server certificate across multiple site visits, nor do they offer a way to not trust a PKI-chaining certificate automatically. The essence of TOFU is that each party initiating a connection individually makes a trust decision, and these decisions are not delegated/federated out. PKI does delegate that decision to CAs, and them using an automated process does not make the entire system TOFU. Yes, clients could be doing all kinds of different things such as DANE and DNSSEC, SSH-like TOFU etc., but they aren't, and the purpose of a system is what it does (or, in this case, doesn't).

Spivak 2y ago
Web PKI is not TOFU in the specific instance where you have an a priori trusted url you know about. But I, and others, argue that this isn't actually that strong of a guarantee in practice. I'm just trusting that this URL is the real life entity I think it is. The only thing you get is that you're connected to someone who has control of the domain. And it's pretty clear that with ACME and DNS challenges we don't need a huge centralized system to do this much weaker thing, you just need any DNS server you trust, it can even be yours.
- lxgr 2y ago
  > The only thing you get is that you're connected to someone who has control of the domain. Yes, that's the entire scope of the web PKI, and with the exception of EV certificates it never was anything else. > it's pretty clear that with ACME and DNS challenges we don't need a huge centralized system to do this much weaker thing Agreed – what we are doing today is primarily a result of the historical evolution of the system. "Why don't we just trust the DNS/domain registry system outright if we effectively defer most trust decisions to it anyway" is a valid question to ask, with some good counterpoints (one being that the PKI + CT make every single compromise globally visible, while DANE does not, at least not without further extensions). My objection is purely on terminology: Neither the current web PKI nor any hypothetical DANE-based future would be TOFU. Both delegate trust to some more or less centralized entity.