[Cryptography] distrusted root CA: WoSign

[Viktor Dukhovni]

> On Oct 2, 2016, at 1:33 PM, Ben Laurie <ben at links.org> wrote:
> 
>> Well, DANE is strictly stronger than DV, because it is tied to
>> direct evidence of domain control, via the domain management account
>> of the domain owner at the registrar/registry that publishes the
>> DS records on the owner's behalf.
>> 
>> Whereas, DV is a point in time, MiTM-vulnerable, leap-of-faith by
>> any one of a multiplicity of CAs that perform cursory "verification"
>> of domain control.
> 
> I don't understand why that makes DANE strictly better.

Well every failure mode for DANE (loss of domain control) is also
a failure mode for DV, but DV has additional failure modes.  Anyway
we don't need to dissect this in gory detail.  There are no silver
bullets, it is trade-offs all the way down.

-- 
	Viktor.