<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 09/07/2013 04:20 PM, Phillip Hallam-Baker wrote:<br>
</div>
<blockquote cite="mid:CAMm+LwgzrjNYagGMgJphSynxoDwLbuTB93g+Te1ov6ZLqTHRgQ@mail.gmail.com" type="cite">
<div dir="ltr"><br>
<div class="gmail_extra">
<div class="gmail_quote">
<div>Before you make silly accusations go read the VeriSign Certificate Practices Statement and then work out how many people it takes to gain access to one of the roots.</div>
<div><br>
</div>
<div>The Key Ceremonies are all videotaped from start to finish and the auditors have reviewed at least some of the ceremonies. So while it is not beyond the realms of possibility that such a large number of people were suborned, I think it drastically unlikely.</div>
<div><br>
</div>
<div>Add to which Jim Bizdos is not exactly known for being well disposed to the NSA or key escrow. </div>
<div><br>
</div>
<div><br>
</div>
<div>Hacking CAs is a poor approach because it is a very visible attack. Certificate Transparency is merely automating and generalizing controls that already exist. </div>
<div><br>
</div>
<div>But we can certainly add them to S/MIME, why not.</div>
</div>
<div><br>
</div>
</div>
</div>
</blockquote>
VeriSign is one single certificate authority. There are many, many more certificate authorities spread across the world, and unless you can guarantee an air-gapped network with tightly constrained physical security controls and a secret videotaped bohemian
ceremony such as the one you reference above at each and every one of those CAs, then maybe it's not such a "silly accusation" to think that root CAs are routinely distributed to multinational secret services to perform MITM session decryption on any form
of communication that derives its security from the CA PKI.<br>
<br>
To whit: "...Mozilla maintains a list of at least 57 trusted root CAs, though multiple commercial CAs or their resellers may share the same trusted root)." [<a href="http://en.wikipedia.org/wiki/Certificate_authority">http://en.wikipedia.org/wiki/Certificate_authority]</a><br>
<br>
Another relevant read: <a href="http://www.quora.com/SSL-Certificates/How-many-intermediate-Certificate-Authorities-are-there#">
http://www.quora.com/SSL-Certificates/How-many-intermediate-Certificate-Authorities-are-there#</a><br>
<br>
</body>
</html>