[128973] in North American Network Operators' Group
Re: DNSSEC and SSL
daemon@ATHENA.MIT.EDU (Gary Buhrmaster)
Sat Aug 21 21:46:49 2010
In-Reply-To: <4C7076B5.9050103@kenweb.org>
Date: Sat, 21 Aug 2010 18:46:39 -0700
From: Gary Buhrmaster <gary.buhrmaster@gmail.com>
To: ML <ml@kenweb.org>, nanog@nanog.org
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On Sat, Aug 21, 2010 at 18:00, ML <ml@kenweb.org> wrote:
> Would a future with a ubiquitous DNSSEC deployment eliminate the market
> for commercial CAs?
>
> Would functioning DNSSEC + self signed certs be more secure/trustworthy
> than our current system of trusted CAs chosen by OS/browser developers?
See Dan Kaminski's presentation at this years BlackHat & Defcon
for a proposal, and the prototype "glue" that provides a proof of
concept. http://www.recursion.com/talks.html (I seem to recall
the X.509/CA part starts about 3/4 of the way through the deck).
That said, Dan does not suggest that everything a CA does
is obsolete, there will still be a market for making sure that
BankOfAmerica.com really is the bank you want to do
business with (branding).
