Subject: [Trans] A counter-argument (Re: DNSSEC also needs CT)

From: Nico Williams <[email-masked]>
Date: Fri, 9 May 2014 20:06:32 -0500

A counter-argument would be that DNSSEC is like PKI with name
constraints done properly, and with most domains being children of
TLDs, there's really only two entities that can MITM them: the root
and the TLD registrars.

Therefore the risk of dishonest "CAs" is lower for DNSSEC than it is for PKI.

I've seen skepticism about CT along the lines of "who will pay?" and
"it's just another tax".  I don't think that should be dismissed out
of hand.  But I do think that in the long run we should do anything
that we can do and that is economical (very important, that) to make
it easier to at least catch misbehaving CAs/registrars/...  the jury
is still out as to whether CT be economical, right?

Nico
--

---

From: Warren Kumari <[email-masked]>
Date: Sat, 10 May 2014 06:30:46 -0400

> TLDs, there's really only two entities that can MITM them: the root

... and the (outsourced) DNS operator and the DNS parent(s) / registry..

This is also the set of folk who can update  / return other answers
for MX queries, and so, if willing to dink with stuff, could obtain a
domain validated cert. I suspect we may be getting somewhat off topic
for Trans, and into discussions we have had a number of times on the
DANE list...
W

> _______________________________________________
> Trans mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/trans