Re: [keyassure] Bare keys again

[Douglas Otis <[e-mail]>]

On 3/23/11 3:30 AM, Paul Wouters wrote:
> On Mon, 21 Mar 2011, Paul Wouters wrote:
>
>>> Trying to use DANE as a means of eliminating X.509 from TLS is a 
>>> non-starter as far as I am concerned.
>>
>> That has been loud and clear. However, it does not mean others should 
>> stop trying to innovate and move forward.
>
> Especially considering the latest CA compromise where a CA issued a rogue
> certificate for addons.mozilla.org. And this is not some el cheapo CA,
> but one that is respected and has people very active within the IETF, the
> good guys....
>
> http://blog.torproject.org/blog/detecting-certificate-authority-compromises-and-web-browser-collusion 
>
>
> This is another clear signal that DANE is needed, and the need for the
> X509 storage format is unneccessary. So people can simply take control
> of SSL for servers within their own DNS zones.
Could this end the practice of stapling Certs to server responses that 
might be cached for weeks to support ultra-fast browsers?  Perfect 
MitM.  Do these browser insist on seeing valid nonce extensions, as this 
would hurt performance?

-Doug