[Cryptography] New SSL/TLS certs to each live no longer than 47 days by 2029

[Michael Kjörling]

On 24 Apr 2025 12:49 -0700, from andrew at joseon.com (Andrew Lee):
>>>> I still think that from our cryptographic viewpoint, there's still
>>>> the issue that this is comparing one PKI vs another, and there's a
>>>> whole lot of complication there, particularly when we think about
>>>> what we could add on to safeguard against an adversary who is an
>>>> owner of a TLD. What's the analogue of CAA, at least in part? CAA
>>>> props up weaknesses in the WebPKI via DNS (SEC or not), what would
>>>> be an analogue?
>>> 
>>> An analogue to this is decentralizing trust on blockchain (the
>>> current best solution to ____ centralization).
>> 
>> All other issues with blockchain technology aside, in what way does
>> DNS CAA RRs (which restrict the set of CAs authorized to issue
>> certificates for a given host name) solve the same problem as using a
>> horrendously energy-intensive, storage- and bandwidth-hungry
>> technology such as proof of work blockchain to distribute trust
>> anchors for host names (and for DNSSEC no less)?
> 
> The CAA RR doesn’t do much since DNS can have a number of actors in
> control along the pipeline. [...]

You used a lot of words in your reply but it appears to me that you
forgot to answer the question that both I and Jon Callas posed, and
which you cut from your reply. (I am including those portions again
above for completeness.) If you did include an answer to the question,
I'm afraid it was buried too deep within the unrelated text, in which
case I invite you to, for clarity, re-post the actual answer portion
of your post _without_ the additional unrelated material, or at the
very least re-flow your post so that it is clearer what you claim the
answer to be.


> Energy, storage and minimal bandwidth is a tiny price to pay for that.

Hard disagree. Consider the current scientific consensus in climate
science for just one reason why. Also proof-of-work blockchain can
hardly count as using, as you would appear to claim, "minimal
bandwidth".

-- 
Michael Kjörling
🔗 https://michael.kjorling.se