On Mon, Apr 12, 2021 at 12:10 PM Nico Williams <nico@xxxxxxxxxxxxxxxx> wrote:
On Mon, Apr 12, 2021 at 11:59:58AM -0400, Phillip Hallam-Baker wrote:
> > As long as it's not over UDP, or otherwise first has a return
> > routability check.
>
> I don't follow.
"No magnification DDoS please"
Oh, I have that built into the key exchange phase.
> If you have a low level IoT device, you are probably better off doing
> path math properly in one trusted device in your network than relying
> on whatever embedded code is running in your toaster.
Absolutely. There is a trade-off to make. Low-power && low-value RPs
should prefer stapling, or even a local caching recursive resolver to do
all the lookups and signature verification too.
If I was still doing PKIX, my long term plan would be to get rid of OCSP and move to short lived certs created using thresholded techniques. But I am not and nobody is paying me to think about that world any more.
