What happened to PKCROSS?
Nico Williams
nico at cryptonector.com
Wed Jul 2 16:15:29 EDT 2014
BTW, DANE stapling is not that hard. I have been pointed at AGL's
code for it. The RP side doesn't need a DNSSEC resolver to implement
it because all the records are stapled, and the RP doesn't need to
implement non-existence checking and so on -- just validate the
signature chain to the RP's DNSSEC root and check "name constraints".
Producing the stapled data is not hard either. There's a Python
script that uses dig(1) that supports this. It needs to learn to be a
daemon that wakes before the shortest TTL passes to refresh the chain.
Stapling should result in fewer external dependencies for the Kerberos
libraries, so that's a big win.
Nico
--
More information about the Kerberos
mailing list