[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Wes Hardaker: opportunistic encryption deployment problems
I guess I have to ask a really dumb question. Given the
likelihood of DNSSEC any time soon, why don't we just
ignore any pretense of authentication with opportunistic
encryption and just accept the MITM attack inherent with
ephemeral DH exchanges? Also: it seems to me that expecting
a secure DNS isn't actually opportunistic at all: it's
trying to assert a different source of (sometimes strong)
identity, which obviously runs afoul of the mythical
global PKI, which leads back to point one. I think there's
some utility to crypto which accepts MITM as better than
nothing at all which is the current reality.
Mike
Bill Manning writes:
>
> One point. Instead of TXT records for stuffing bits into, there is the CERT record
> which was designed for just such stuff.
> Well, two points. If folks want to kick the tyres on such a beast, I've a couple
> of servers w/ signed in-addr.arpa zones.
>
>
> --
> --bill
Follow-Ups:
References: