On 5/3/19 11:41 PM, Bill Cole wrote:
This is all true of any authentication mechanism: if control of authenticating credentials is lost, the authentication is worthless.
Agreed.
For example, if someone can control the DNS for tnetconsulting.net, they can very likely get Comodo to reissue your S/MIME cert and send it to them instead of you. At that point they can sign mail as you in a manner that normally would be seen as more robust and more reliable than DKIM.
Yep. Hence the repudiation comment.I'm afraid that our industry is painting themselves into a corner and we may not realize it until it's too late.
"Jury of peers" is going to be more and more problematic. Not only will it need to be peers that understand the technologies in play, but peers that understand the ramifications of the weird failure modes.
BUT: you have an advantage over many victims of DNS compromise in that tnetconsulting.net has implemented DNSSEC.
}:-)As long as they only compromise my DNS and /don't/ compromise my registrar, things should be relatively okay. At least in that there is a higher authority that can be used to correct things top down.
My understanding is that DNSpionage & Sea Turtle did compromise things at the registrar level. As such, they can alter the DS records and even overcome DNSSEC.
Also, DKIM is potentially less vulnerable to DNS compromise than PKI-reliant X.509 certificates (which DNSpionage & Sea Turtle target) because the protocol is designed to support short-lived keys distributed over DNSSEC so that a compromise of DNS needs to be persistent and stealthy to live longer than a signed TXT record.
Sure. Smaller exposure window. -- Grant. . . . unix || die
smime.p7s
Description: S/MIME Cryptographic Signature
