full-disclosure - Re: The merits and uses of CAs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 05 Jan 2009 20:43:52 -0500
From: Valdis.Kletnieks@...edu
To: Christopher Pritchard <mailinglist@...iniacghost.co.uk>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: The merits and uses of CAs

On Mon, 05 Jan 2009 23:55:59 GMT, Christopher Pritchard said:
> previous certificate became invalid (for example due to a date issue). It
> should also be possible to have semi-centralised CRLs that browsers would
> check for occasions when the server admin wants to change certificates, they
> could post the old one up on the list and the browser wouldn't warn when a
> new certificate is presented.

Something to consider:  In most cases, the CRL that you are supposed to check
to see if a cert has been revoked is listed *in the cert you're checking*.
That's all fine and dandy if you're dealing with a legitimate CA that's
revoking a cert for good reason.  However, it is interesting to consider
what happens when a dodgy CA issues a cert - they have some good reasons
to point the CRL at never-never land.

So - if you were a miscreant running a dodgy CA, where would *you* point
the CRL?

If you were a browser designer, what would you do if you found a CRL that
pointed nowhere?  One option is to not allow the use of a cert that you can't
contact the CRL - except that becomes a massive single point of failure. If
users can't do their home banking because their bank's CA is unreachable due
to severe backhoe fade, they won't be very happy with their browser.

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/