Re: [Acme] dns-01 challenge limitations

[Kas <[e-mail]>]

On 9/13/2020 12:13 PM, Simon Ser wrote:
> Ultimately, ACME clients need a way to update DNS records to solve the dns-01
> challenge. Ignoring and pushing the problem down to the DNS operators does not
> fix the root cause.
I can't agree more, so what about going after dns-02 challenge instead 
of trying to fix this ?

(And this is up for discussion and as food for thought.)
Lets say dns-02 challenge will be little different where the DNS record 
will hold a public key for specific(or per) domain/subdomain and ACME 
client will pass the server challenge by using the correspondent private 
key for that public key to pass the challenge from the server, where 
server will verify against the DNS published public key, means no DNS 
access from client side at the time of the challenge itself.

This might solve the need for DNS API or even accessing the DNS from the 
client altogether, this will solve and simplify the challenge while do 
not compromise the security of the challenge itself and will not 
compromise the DNS records for the DNS administrators piece in mind, on 
contrary it will give the ability to control DNS handling on the client 
side in more secure way, and yet if a client have the ability to change 
the public key then this will revert to something very similar to 
dns-01, so in that case ( when it can access and modify the DNS records) 
client can choose between dns-01 and dns-02, which i don't see need any 
discussing more that dns-01 itself.

Is such challenge viable and secure ? did i missed something obvious 
with such suggestion ?