[Cryptography] Against against DNS (Re: New SSL/TLS certs to each live no longer than 47) days by 2029

[Paul Wouters]

On Fri, 25 Apr 2025, Peter Gutmann wrote:

> Jon Callas <jon at callas.org> writes:
>
>> The Geoff Huston essay that Michael Kjörling posted,
>> <https://blog.apnic.net/2024/05/28/calling-time-on-dnssec/>, is from May 2024
>> and jibes with it pretty much. Nine years pass, and while some of the lyrics
>> might have changed, the song is still the same.

I'm not debunking that again. Several errors I pointed out he refused to
fix, alongside misleading list on ianix of DNSSEC outages of which a
number of them were generic DNS/routing outages.

> It actually stretches over a much longer time period, Thomas Ptacek's original
> series of essays, which went into much more detail than the 2015 post, was
> "The Case Against DNSSEC" from 2007, about the same time attempts were first
> made to deploy it.  The APNIC post, incidentally on a blog run by an
> organisation charged with deploying DNSSEC, that it's essentially failed, is
> telling: It's solving a problem that most people don't care about at a cost
> that most people do care about.

Yet more and more public keys are stuffed in the DNS, the latest set
being the TLS EncryptedClientHello("ECH") ones. Where the only way to
sort of use them securely (without requiring DNSSEC) is to use DoH, eg
use very centralized DNS servers (quad 1,8,9) that are easiest to force
into censorship. It centralizes the web even more.

Mail has the same thing with MTA-STS being a 30 page workaround RFC for
not wanting to use DNSSEC (where a few more RTTs doesn't even matter)

Then there are the zillions of domain ownership verification records
being used without DNSSEC.

People currently might not "care about" protecting DNS content, but they
will care once we see more and more attacks on these DNS public keys and
tokens causing security issues. Right now, people don't care because its
just easier to own people using email attachments. But all this is still
technical debt accumulating.

Anyway, it's really saying IPv6 doesn't fix a real problem and no one
cares about IPv6. It's a generation of people used to IPv4 and simple
fire and forget DNS zones files that can't evolve into a more complex
modern universe they live in. Things will get better once they retire :P

And TLS being too much controlled by too few people with a narrow focus
on WebPKI isn't helping either. Too bad we (ietf) didn't learn from
the OAUTH mistake - where people eventually did it outside of the IETF,
and started OpenID.

Paul