- Site menu:
- Latest Discussions
- Latest Newswire
- Archives
- Submit Story
- Story HOWTO
- Syndicate
- E-mail Alerts
HTTPS Certificate Revocation is broken, and it's time for some new tools
|
|
|
Comments (1)
Post a comment
A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.
Your message:Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help
Sign up and post (it is free) or Log in and post
DKIM works this way.... and DKIM along with DNSSEC provides DNS root level security of email servers. The same could easily be implemented with TLS...
It's almost there.
As indicated in the article CAA is a DNS record specifying the CA. There's actually zero difference from a security perspective to simply insert the public key for the server in DNS.
If instead of listing a CA in DNS, the domain owner created a public/private key and inserted the public key in DNS... then CAs go away entirely. Therefore there would be no problem with rogue CAs, because the domain owner would have full control and responsibility over the TLS public/private key. This would also allow key agnostic systems. PGP keys could be used as well as x509 systems.
We'll see if the 'security community' realizes the better solution... but some of my tech managers in prior work experiences were fond of saying that:
"Managing engineers is like herding cats."
So, it may be a long time before the 'experts' realize the better solution to TLS key assurance.