IETF Logo Mail Archive

Re: [DNSOP] Whiskey Tango Foxtrot on key lengths...

Christopher Morrow <christopher.morrow@gmail.com> Thu, 27 March 2014 19:26 UTC

Return-Path: <christopher.morrow@gmail.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A0AB71A06D8 for <dnsop@ietfa.amsl.com>; Thu, 27 Mar 2014 12:26:22 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2sW9x8S8sE-2 for <dnsop@ietfa.amsl.com>; Thu, 27 Mar 2014 12:26:21 -0700 (PDT)
Received: from mail-la0-x234.google.com (mail-la0-x234.google.com [IPv6:2a00:1450:4010:c03::234]) by ietfa.amsl.com (Postfix) with ESMTP id 5B7EC1A0755 for <dnsop@ietf.org>; Thu, 27 Mar 2014 12:26:20 -0700 (PDT)
Received: by mail-la0-f52.google.com with SMTP id ec20so2950289lab.39 for <dnsop@ietf.org>; Thu, 27 Mar 2014 12:26:17 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; bh=fkGv52SrymUagonffvnOaolGo2YKnu5IpPR/Awa6vxA=; b=v6P1VI2Pgn6ZY0T+/uhiEP4hm9Tl5sQVVlTCKpL9KQfVXcnoKQPnaptsC9PaBwsGqN r5LJE2mbq8A/Lyn5X/ggVIXrQpoVbmtGYqbT4VgPuWWhMlaQwLSadnlIzcxMvmm4Z3JJ Zviz/rDJEITTXVesMeDF8wUnp2eZn/UMuVUGBvnGgsy9qIaKDJ4fMDFPlhSdKNzMAHT6 s2z2sohGPKypSQVvPE5oAKgbGSP1vP13eTEuGpxc40a3Mq4RN3lCOrECUCCR0SP3vNT2 QifV/MZ/MSB8uSCFvqdxOGq6lr6t3yh8pKsQy4NJlKaYGIc5lozDUytuvN77FreoiiB1 YZEA==
MIME-Version: 1.0
X-Received: by 10.152.18.229 with SMTP id z5mr2081434lad.27.1395948377918; Thu, 27 Mar 2014 12:26:17 -0700 (PDT)
Received: by 10.152.45.196 with HTTP; Thu, 27 Mar 2014 12:26:17 -0700 (PDT)
In-Reply-To: <734640E6-6393-4EBF-BE36-5C05026027E5@icsi.berkeley.edu>
References: <0EA28BE8-E872-46BA-85FD-7333A1E13172@icsi.berkeley.edu> <4B70E4D6-6750-4E5A-9058-7F94588DEF4C@vpnc.org> <CAL9jLaaAYPfRNSmoO=G+q2JA4a2RVsV-z-0o3RFY7r+dQN-a_w@mail.gmail.com> <734640E6-6393-4EBF-BE36-5C05026027E5@icsi.berkeley.edu>
Date: Thu, 27 Mar 2014 15:26:17 -0400
Message-ID: <CAL9jLaYtKogx-Uk7d4KDpmCNLN7jCiuf5n-OhY+NsCnFap8v3Q@mail.gmail.com>
From: Christopher Morrow <christopher.morrow@gmail.com>
To: Nicholas Weaver <nweaver@icsi.berkeley.edu>
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable
Archived-At: http://mailarchive.ietf.org/arch/msg/dnsop/eKXW7vXXRgm8WZz_D3X3O0kiWCo
X-Mailman-Approved-At: Thu, 27 Mar 2014 12:26:45 -0700
Cc: dnsop WG <dnsop@ietf.org>, Paul Hoffman <paul.hoffman@vpnc.org>
Subject: Re: [DNSOP] Whiskey Tango Foxtrot on key lengths...
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 27 Mar 2014 19:26:22 -0000

On Thu, Mar 27, 2014 at 2:39 PM, Nicholas Weaver
<nweaver@icsi.berkeley.edu> wrote:
>
> On Mar 27, 2014, at 11:18 AM, Christopher Morrow <christopher.morrow@gmail.com> wrote:
>
>> On Thu, Mar 27, 2014 at 10:52 AM, Paul Hoffman <paul.hoffman@vpnc.org> wrote:
>>> Yes. If doing it for the DNS root key is too politically challenging, maybe do it for one of the 1024-bit trust anchors in the browser root pile.
>>
>> why would this be politically sensitive?
>
> Because the browsers have already decided killing of 1024b CAs is a good idea, and they could revoke just those CAs once someone breaks a 1024b example, since the browser vendors have good experience in revoking bad CAs already (queue DigiNotar...)
>
>
> In contrast, DNSSEC seems mired in a 1024b swamp at the root, and when you can use an old key (which you can for the root, since you can fake everything up below that dynamically and fake NTP so that your bad key is still kosher), breaking a root key really would be breaking DNSSEC.


that didn't answer the question really? Do you mean: "NTIA/ICANN (pick
your place depending on day and worldview) would be upset that someone
proved there are no pants on the emperor."

I'm not sure that matters though? Just because you did it and
published the result/example doesn't mean that this isn't already
happening all over the net, right? I don't know that there's a reason
to NOT do the experiment and publish, without some impetus, what's
going to drive the change? given other priorities that exist and
already have leadership attention...

Why don't you just go do the experiment nick and let us know how it goes?

v2.23.0 | Report a Bug | By Email