News for hackers. Stuff that matters.

A comment on Private key of DigiCert Certificate Transparency log compromised. Parent comment

Re:Private key of DigiCert Certificate Transparency log comp... by Avamander on Thursday May 28, 2020 @05:09PM (#23342676)
With the CT system I can monitor the CA's issuance, with DNSSEC I can't retroactively monitor if someone has changed the DANE keys and intercepted traffic.
[ Parent | on HN ]
Re:Private key of DigiCert Certificate Transparency log comp... by dane-pgp on Thursday May 28, 2020 @08:53PM (#23345077)
True, DNSSEC Transparency is not as developed a technology as Certificate Transparency. There has been experimental deployment of such a system[0] but to give higher assurance there is a small addition to the DNS data that needs to be adopted first[1], which is still going through the IETF process.

[0] https://twitter.com/ln4711/status/754516056878772224

[1] https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-deleg...

[ Parent | on HN ]
Re:Private key of DigiCert Certificate Transparency log comp... by tptacek on Friday May 29, 2020 @10:45AM (#23350492)
Certificate Transparency, by contrast, exists.
[ Parent | on HN ]
Re:Private key of DigiCert Certificate Transparency log comp... by dane-pgp on Friday May 29, 2020 @11:06AM (#23350776)
There was a time when Certificate Transparency didn't exist, and people didn't propose throwing away the web PKI because of that.
[ Parent | on HN ]
Re:Private key of DigiCert Certificate Transparency log comp... by Avamander on Friday May 29, 2020 @03:52PM (#23354710)
Yeah, because Web PKI existed, DNSSEC has yet to gather any meaningful good deployment. It's not hard to throw away something that doesn't exist :P
[ Parent | on HN ]