[Cryptography] Why aren’t we using SSH for everything?

[Christoph Anton Mitterer]

On Sat, 2015-01-03 at 23:14 -0800, Tony Arcieri wrote: 
>         >> It's not because SSH supports an X.509-like CA system
>         >?? 
>https://www.digitalocean.com/community/tutorials/how-to-create-an-ssh-ca-to-validate-hosts-and-clients-with-ubuntu 
Well this is what I've mentioned before, but it is, as I've said, not
X.509.


> You are the vocal minority 
How would you know?

On Sat, 2015-01-03 at 23:15 -0800, Tony Arcieri wrote:
>Forgot to add: this process does not sound like it can scale to every
>user on the Internet and every service on the Internet, sorry
Well sure, but that's not a problem, since this is not needed with
SSH... and if it was needed, because someone would want to use SSH for
tunnelling to arbitrary remote servers, you could simply implement a
X.509 based (or anything better) host authentication system (or use the
one that already exists).

Apart from that,... everyone should know by now, that the X.509 / CA
based trust system we have in TLS is inherently broken... alone the fact
that you have several 100 CAs in your browsers, many completely
untrustworthy or proven to be incompetent.
So probably the best possible way to have a strict hierarchical system
would be DANE.

And for DANE in turn, you could just place your SSH keys in DNS. Scales
as good as anything else.


Cheers,
Chris. 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5313 bytes
Desc: not available
URL: <http://www.metzdowd.com/pipermail/cryptography/attachments/20150104/cbc1081b/attachment.bin>