Announcing httpsy://, a YURL scheme

[Ed Gerck]

Ben Laurie wrote:

> Ed Gerck wrote:
> > Also, in general, we find that one reference is not enough to induce trust. Self-references
> > cannot induce trust, either (Trust me!). Thus, it is misleading to let the introducer
> > determine the message target, in what you call the "y-property". Spoofing and
> > MITM become quite easy to do if you trust an introducer to tell you where to go.
>
> What is a CA other than an introducer?

Maybe that's why CAs are still around...they do not tell you where to go. Instead,
there are two assertions that a CA should deliver in a certificate according to X.509:

(i) that the subject’s public-key has a working private-key counterpart somewhere, and

(ii) that the subject’s DN is unique to that CA.

These assertions should also be delivered without content disclaimers but are limited
in scope by the CPS. In addition, in both cases caveats apply. For example, in (a),
there are no warranties that the public/private key pair is not artifically weakened,
that the private key is actually in the possession of the named subject and that no
one else has obtained a copy of the private key. In (b), there are no warranties that
such DN contains the actual subject’s name, location or that the subject even exists
or has a correctly spelled name.

(From Overview of Certification Systems, E. Gerck, 1997, copy
at  http://www.thebell.net/papers/certover.pdf )

Cheers,
Ed Gerck



---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com