Attackers control connectivity. Connectivity is expensive. Connectivity is also unreliable: captive portals, proxies, and firewalls break it. These factors make OCSP certificate revocation unworkable. For similar reasons, they make DANE's ostensible safeguard against malicious CAs unworkable. In practice, DANE would probably only be usable as an additional CA; it would not be able to effectively overrule any of the 1482 existing CAs.
Comments
The meatiest bit of this article, which is great:
Attackers control connectivity. Connectivity is expensive. Connectivity is also unreliable: captive portals, proxies, and firewalls break it. These factors make OCSP certificate revocation unworkable. For similar reasons, they make DANE's ostensible safeguard against malicious CAs unworkable. In practice, DANE would probably only be usable as an additional CA; it would not be able to effectively overrule any of the 1482 existing CAs.
Slightly off-topic: Could you please add RSS support to your "blog"? I'm sure others, besides me, would love to me notified of new entries. Thanks!