Advertisement
GStreamer Conference 2013, 22-23 Oct, Edinburgh
GStreamer, Embedded Linux, Android, VoD, Smooth Streaming, DRM, RTSP, HEVC, PulseAudio, OpenGL. Register now to attend.
| |||||||||||||
Appraisal of DNSSEC-based certificate verificationAppraisal of DNSSEC-based certificate verificationPosted Sep 27, 2013 20:01 UTC (Fri) by Cyberax (✭ supporter ✭, #52523)In reply to: Appraisal of DNSSEC-based certificate verification by error27 Parent article: Encouraging a wider view
It's not really viable. While NSA can push Verisign it has absolutely no control over the other top-level domains.
For example, one can host a site in .ua (Ukraine). In this case to surreptitiously intercept your traffic NSA will have to redirect the whole .ua top-level domain and use faked certificates - it's possible if they have full control over your pipe.
But it can be beaten fairly easy - just use 'sticky' DNSSEC keys. Since there are just over 300 top-level domains and DNSSEC key rotation happens rarely it's not that burdensome. Also, the mechanics of redirection itself are quite complicated.
This is way better than having 500 CAs each of which can be used to create a certificate for ANY site.
(Log in to post comments)
|
|||||||||||||