Re: [Acme] kinds of proof

[Viktor Dukhovni <[e-mail]>]

On Tue, Dec 02, 2014 at 01:18:20AM +0000, Christian Huitema wrote:

> > Yes, several CAs allow DNS based validation of control.

I thought this too obvious to mention, I was talking *additional*
verification methods other than DNS.

> To belabor the obvious: if someone somehow controls the DNS entry
> for the domain, they can put up a MITM attack and "insert" whatever
> content is suitable for validation.

That's not an attack.  If you control the DNS, you control the
domain, which is what DV is supposed to verify.

I'd like to see is that resolvers used by CAs should support DNSSEC,
and for signed domains apply the appropriate checks.  Which then
leaves room for MiTM attacks via the various DV email addresses,
and port 80 checks, which perhaps should be re-considered when the
candidate DV domain is signed.

-- 
	Viktor.