3 ms·

Basically reinventing DNSSEC?

by gzread 7mo ago

amluto 7mo ago
Nope. DNSSEC is a complex scheme that is designed to allow queries to be answered with no secrets know to the answering nameserver: everything is signed offline and signed records are served up. My (vague) suggestion is to use a much simpler online scheme with correspondingly lower performance, but to use it only for security-critical queries such as those made by CAs.
- gzread 7mo ago
  So a whole alternative DNS tree just for verifying domain ownership to CAs? Or would it be the same tree? If it's the same tree why not extend it to all records, all the time?
  - amluto 7mo ago
    For better or for worse we have a system designed for exceptional scalability and performance for verifying that you’re talking to the domain name that you think you’re talking to: WebPKI. It’s all kinds of outdated, baroque, and crappy, but it works and is supported by basically everything. We keep taking little baby steps toward making it suck less (dns-persist-01 is an upcoming one that I’m excited about). And all these little baby steps can be deployed worldwide without modifying client software. DNSSEC tries to fit in a weird corner of the performance envelope. It requires modifying client software to get more than a token benefit. Approximately zero clients use it for anything worthwhile. The technology is terrible. It’s really not fit for any particular purpose. About the best one can say for using it to help with domain validated certificate issuance is that it exists, but, as widely noted, it’s so awful that even major high-budget websites don’t use it. At the end of the day, domain validation is a heavyweight process that needs to be reliably but not fast. All it’s doing is, in effect, asking the DNS hierarchy whether the certificate requester is authorized. A much MUCH simpler solution would be to … just ask the chain of authoritative DNS servers. This query does not need to be scalable. It does not need to be fast. It does not need to meet almost any of the ridiculous pile of requirements that led to DNSSEC. Heck, it doesn’t even need to be possible for unauthenticated users to issue queries at all. Sometimes specific problems deserve specific, narrowly tailored solutions.

Basically reinventing DNSSEC?

by gzread 7mo ago

Basically reinventing DNSSEC?

Nope. DNSSEC is a complex scheme that is designed to allow queries to be answered with no secrets know to the answering nameserver: everything is signed offline and signed records are served up. My (vague) suggestion is to use a much simpler online scheme with correspondingly lower performance, but to use it only for security-critical queries such as those made by CAs.

gzread 7mo ago
So a whole alternative DNS tree just for verifying domain ownership to CAs? Or would it be the same tree? If it's the same tree why not extend it to all records, all the time?
- amluto 7mo ago
  For better or for worse we have a system designed for exceptional scalability and performance for verifying that you’re talking to the domain name that you think you’re talking to: WebPKI. It’s all kinds of outdated, baroque, and crappy, but it works and is supported by basically everything. We keep taking little baby steps toward making it suck less (dns-persist-01 is an upcoming one that I’m excited about). And all these little baby steps can be deployed worldwide without modifying client software. DNSSEC tries to fit in a weird corner of the performance envelope. It requires modifying client software to get more than a token benefit. Approximately zero clients use it for anything worthwhile. The technology is terrible. It’s really not fit for any particular purpose. About the best one can say for using it to help with domain validated certificate issuance is that it exists, but, as widely noted, it’s so awful that even major high-budget websites don’t use it. At the end of the day, domain validation is a heavyweight process that needs to be reliably but not fast. All it’s doing is, in effect, asking the DNS hierarchy whether the certificate requester is authorized. A much MUCH simpler solution would be to … just ask the chain of authoritative DNS servers. This query does not need to be scalable. It does not need to be fast. It does not need to meet almost any of the ridiculous pile of requirements that led to DNSSEC. Heck, it doesn’t even need to be possible for unauthenticated users to issue queries at all. Sometimes specific problems deserve specific, narrowly tailored solutions.