News for hackers. Stuff that matters.

A comment on The DNS-Based Authentication of Named Entities (DANE) TLS Protocol.

Re:The DNS-Based Authentication of Named Entities (DANE) TLS... by jakobdabo on Monday August 29, 2016 @02:27PM (#12383994)
Is it an insane idea to incorporate the blockchain technology into the current PKI system so that every time a CA signs a key it must insert a new transaction into the blockchain which links it to the certificate? We could have a full, transparent and cryptographically secure certificate log.
[ Parent | on HN ]
Re:The DNS-Based Authentication of Named Entities (DANE) TLS... by icebraining on Monday August 29, 2016 @03:44PM (#12384677)
That's called an hash chain[1], they've been around for a while. In my country, receipts systems are actually required to implement hash chaining to allow the authorities to detect "missing" receipts (for tax-avoidance control purposes).

[1] https://en.wikipedia.org/wiki/Hash_chain

[ Parent | on HN ]
Re:The DNS-Based Authentication of Named Entities (DANE) TLS... by hannob on Monday August 29, 2016 @02:36PM (#12384098)
It's actually one of the few non-insane ideas about blockchains. But it has already been done as another commenter already posted.
[ Parent | on HN ]
Re:The DNS-Based Authentication of Named Entities (DANE) TLS... by lziest on Monday August 29, 2016 @02:28PM (#12384007)
check out certificate transparency https://www.certificate-transparency.org/
[ Parent | on HN ]
Re:The DNS-Based Authentication of Named Entities (DANE) TLS... by jakobdabo on Monday August 29, 2016 @04:34PM (#12385082)
That's not quite the same, but I just found this NeoDNS[0] proposal, and it seems to be just what I described.

[0] https://rot256.io/post/neodns/

edited: Apparently it was briefly discussed at HN only 2 days ago: https://news.ycombinator.com/item?id=12370146

[ Parent | on HN ]