News for hackers. Stuff that matters.
Re:Why CISA Issued Our First Emergency Directive by tptacek on Sunday February 17, 2019 @11:32AM (#19185234)
I don't believe that this description of DNSSEC functionality inside CAs is accurate. Can you be specific about which CAs you believe do a good job of validating DNSSEC --- not just somehow "running" it, but making use of it operationally?
Re:Why CISA Issued Our First Emergency Directive by tialaramex on Sunday February 17, 2019 @12:30PM (#19185596)
The largest CA by volume, Let's Encrypt, uses DNSSEC for all its validations, and hard fails issuance if it can't get either a DNSSEC validation or the signed denial saying this part of the hierarchy isn't signed, it has done this for years now. Works well.

Several other major CAs including DigiCert do DNSSEC validation but I haven't used them and so can't even tell you from my own experience how well they work, though it seems likely some of their other customers might have noticed on that end.

Now, are they all doing a "good job"? If you actually were paying any attention at all in this space you'd presumably have quoted my already published opinions about that. I think they should retain the DNS responses the same way they would keep the actual raw data from an HTTP validation. So third parties doing incident investigation can do an effective post mortem - I also think they use too many "short cuts" that are going to result in someone finding a nasty bug one of these days and for which there's no real evidence they're necessary.

But since it seems for you a "good job" is just using something operationally, then yeah, in that limited Thomas Ptacek sense of "good job" they're already doing a good job I guess.

Re:Why CISA Issued Our First Emergency Directive by tptacek on Sunday February 17, 2019 @02:17PM (#19186259)
Can you confirm another CA other than LetsEncrypt that will reliably deny issuance on a DNSSEC failure?

(Obviously, just to point something out for the thread that you already know, the vast, overwhelming majority of LetsEncrypt issuances are for zones without DNSSEC signatures).

Re:Why CISA Issued Our First Emergency Directive by tialaramex on Sunday February 17, 2019 @06:13PM (#19187502)
Given that I already wrote that...

> I haven't used them and so can't even tell you from my own experience how well they work

... I'm not sure what my "confirmation" would tell you, beyond that I know how to read the paperwork from the CAs. But sure, both Sectigo and DigiCert say their systems should deny issuance on DNSSEC failure.

Re:Why CISA Issued Our First Emergency Directive by tptacek on Sunday February 17, 2019 @09:13PM (#19188186)
I'm asking because I want to know, not to make a point.