Change to key rotation every 24 hours about dnscrypt-wrapper

[cofyc]

@montvid Updated in 9d0a793.

[cofyc]

Seems reasonable. I will update docs first suggesting user to generate short-term key pairs and use key-rotation mechanism.

Use of ephemeral keys could possibly be used as a template as seen here: https://dnscrypt.is (d0wn's Icelandic servers).

[cofyc]

Docs was updated in #113. I am not going to change the default value of --cert-file-expire-days, because it may violate user expectation.

[montvid]

@cofyc User expectation is safe default settings. The protocol specification has always recommended to keep/use a key for no more than 24 hours comment here. The problem is between you and the people who created dnscrypt - not the users. The creators of dnscrypt put a warning into the code you choose to ignore. You think you know better than the creators of dnscrypt? Users depend on your default settings to be safe so if something bad happens they will blame you not dnscrypt as you don't use recommended defaults!!! I will definitely not use a service that has 1 key for 365 days because if it is compromised all the data of <=365 days is harvested!
Wikipedia article
@X8716e ephemeral keys use too much cpu on a standard openwrt router and https://dnscrypt.is does not have a 24h key rotation so I am not going to use it.

[montvid]

Thanks a lot. Now lets hope more of the servers will implement it. Nice that jedisct1 is running one in France.