[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 10 Oct 2014 20:28:03 +0200
From: Werner Koch <wk@...pg.org>
To: David Leon Gil <coruus@...il.com>
Cc: Daniel Kahn Gillmor <dkg@...thhorseman.net>, kristian.fiskerstrand@...ptuouscapital.com, oss-security@...ts.openwall.com, "gnupg-devel\@gnupg.org" <gnupg-devel@...pg.org>, thijs@...ian.org
Subject: Re: 0xdeadbeef comes of age: making keysteak with GnuPG
On Fri, 10 Oct 2014 18:01, coruus@...il.com said:
> My problem with the HKPS pool is that I don't know Kristian.[1] And I
> don't have any reason to believe that he'd suffer serious financial
X.509 is entirely broken and we can't do anything about it. However, it
gives you some assurance that it is harder to read the requests. But it
is not really hard, they just need to compromise a few well known
keyservers. Let's use hkps to raise the surveilance costs - that is
worth the little trouble.
But do not trust any keyserver! Use your own way to validate the key.
> [2] This is different from saying that I think he *would
> intentionally* sign a malicious cert, which I don't. I just have no
> idea how secure the private key for that CA is. And I know that a
> fully isolated, physically secure facility, and a good HSM are really
> expensive. (But maybe he is doing this?)
Why attacking a certain "high-security" CA if you can easily convice
another of the 1300 (?) primary root CAs to issue a certifciate to your
needs.
BTW: Using a pool with 2.1 will be more reliable because 2.1 tracks
failures of the current server and switches to another one in that
case. Thus you do not need to rely on the DNS round-robin.
Salam-Shalom,
Werner
--
Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
