Phillip Hallam-Baker wrote:
Trust roots have to be valid for at least a decade to be acceptable to
the application vendor community.
? ? ? ?That's a unproved assumption.
It is an observation backed by fifteen years of experience and direct
conversations with the principals for cryptographic security at the
major platform vendors.
PKI, including DNSSEC, is NOT secure cryptographically, but secure
socially or, in other word, weakly secure, subject to social and
other forms of attacks.
PKI, however, is not so insecure, in a sense that plain old DNS
(specified in 1987) is not so insecure and has been valid for
more than a decade to be acceptable to the application vendor
community.
That is the observed fact.
If the broken security model of bailiwick is thrown away,
plain old DNS is made secure enough.
Moreover, plain old DNS is a lot easier to manage than PKI.
Masataka Ohta
_______________________________________________
Ietf mailing list
Ietf(_at_)ietf(_dot_)org
https://www.ietf.org/mailman/listinfo/ietf