|
Date: Fri, 10 Oct 2014 20:28:03 +0200 From: Werner Koch <wk@...pg.org> To: David Leon Gil <coruus@...il.com> Cc: Daniel Kahn Gillmor <dkg@...thhorseman.net>, kristian.fiskerstrand@...ptuouscapital.com, oss-security@...ts.openwall.com, "gnupg-devel\@gnupg.org" <gnupg-devel@...pg.org>, thijs@...ian.org Subject: Re: 0xdeadbeef comes of age: making keysteak with GnuPG On Fri, 10 Oct 2014 18:01, coruus@...il.com said: > My problem with the HKPS pool is that I don't know Kristian.[1] And I > don't have any reason to believe that he'd suffer serious financial X.509 is entirely broken and we can't do anything about it. However, it gives you some assurance that it is harder to read the requests. But it is not really hard, they just need to compromise a few well known keyservers. Let's use hkps to raise the surveilance costs - that is worth the little trouble. But do not trust any keyserver! Use your own way to validate the key. > [2] This is different from saying that I think he *would > intentionally* sign a malicious cert, which I don't. I just have no > idea how secure the private key for that CA is. And I know that a > fully isolated, physically secure facility, and a good HSM are really > expensive. (But maybe he is doing this?) Why attacking a certain "high-security" CA if you can easily convice another of the 1300 (?) primary root CAs to issue a certifciate to your needs. BTW: Using a pool with 2.1 will be more reliable because 2.1 tracks failures of the current server and switches to another one in that case. Thus you do not need to rely on the DNS round-robin. Salam-Shalom, Werner -- Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.