Re: [TLS] Enforcing Protocol Invariants

[Hubert Kario <[e-mail]>]

On Tuesday, 13 November 2018 00:13:58 CET Viktor Dukhovni wrote:
> [ I agree that this thread is off topic for this WG, thus below
>   just a short OT aside on some oft-repeated critiques of DNSSEC. ]
> 
> > On Nov 12, 2018, at 2:15 PM, Tony Arcieri <[e-mail]> wrote:
> > 
> > The cryptography employed by the X..509 PKI is substantially more modern
> > than what's in DNSSEC. Much of DNSSEC's security comes down to 1024-bit
> > or 1280-bit RSA ZSKs.
> It is true that while the KSKs tend to be 2048-bit RSA, ZSKs are typically
> 1024-bits or 1280-bits.
> 
> 	http://stats.dnssec-tools.org/#keysize
> 
> That said, all the TLDs are using 2048-bit KSKs, and we're seeing
> increasing adoption of ECDSA in DSSSEC:
> 
> 	http://stats.dnssec-tools.org/#parameter
> 
> and the .CZ and .BR TLDs switched to ECDSA this year, and more will likely
> follow.
> 
> Furthermore, the weakest link in the chain for both WebPKI and DNSSEC is not
> the cryptography.  Rather it is operational weaknesses in the enrollment
> processes.
> 
> For WebPKI, we basically have TOFU by the CA based on apparent
> unauthenticated control of a TCP endpoint as the basis of certificate
> issuance, occasionally strengthened via DNSSEC(!) validated CAA records
> and/or ACME challenges.

but that TOFU is global, not local to a client

-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 115, 612 00  Brno, Czech Republic