14 Oct 1998 19:48
Re: proof-of-possession for DH keys
Adam Back <aba <at> dcs.ex.ac.uk>
1998-10-14 17:48:23 GMT
1998-10-14 17:48:23 GMT
Steve Kent writes: > Unfortunately, the possible consqquences are worse than the self-inflicted > DoS attack you descibed. Specifically, by having a credible CA issue a > cert binding someone elses public key to the imposter's name, the imposter > can claim to be the signer of traffic associated with someone else (in the > case of a signature key bound into the certificate). But DH keys are not signatures keys, they are confidentiality keys. This was the point being made: that DH POPs (see the subject line) are not (that) useful. The attack you describe relating to signatures keys is obviously true: this is what self certificates protect against. The point with a DH key is that you can't issue a self cert, because it is not a signature key, therefore you define a POP instead, if you want the (small) advantage of a POP for a confidentiality key. Adam -- -- Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U <at> {$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`
, but to allow users to authenticate themselves
using a valid certificate (be it electronical or physical) where the certificate
receiver only must know what issuers (and domain) to trust. This is a major benefit for
all parties as you can have a life-time password/userid replacement with
full security (technically speaking) independent on actual certificate. It simply
cuts costs and confusion (at the expense of personal integrity). If this is
good or not is something the market (and in some cases national laws)
will decide. My personal opinion is that if successful PKIs (Stefan!) are
established based on PPITs the disbeliveers *may* change their mind.
The general-purpose browser solution is as follows:
The authenticating server may surely *suggest* a list of possible certificate types
that it may accept because it is always *you* (the user) that should manually
RSS Feed