IETF Logo Mail Archive

Re: [pkix] An alternative proposal Was: Fwd: New Version Notification for draft-hamilton-cmr-00.txt

"Miller, Timothy J." <tmiller@mitre.org> Thu, 03 November 2011 12:01 UTC

Return-Path: <tmiller@mitre.org>
X-Original-To: pkix@ietfa.amsl.com
Delivered-To: pkix@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D646611E80FA for <pkix@ietfa.amsl.com>; Thu, 3 Nov 2011 05:01:59 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.599
X-Spam-Level:
X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xyRuVZpLiKVb for <pkix@ietfa.amsl.com>; Thu, 3 Nov 2011 05:01:59 -0700 (PDT)
Received: from smtpksrv1.mitre.org (smtpksrv1.mitre.org [198.49.146.77]) by ietfa.amsl.com (Postfix) with ESMTP id 2FD8611E80E8 for <pkix@ietf.org>; Thu, 3 Nov 2011 05:01:59 -0700 (PDT)
Received: from smtpksrv1.mitre.org (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id BFDDF21B1876; Thu, 3 Nov 2011 08:01:54 -0400 (EDT)
Received: from IMCCAS03.MITRE.ORG (imccas03.mitre.org [129.83.29.80]) by smtpksrv1.mitre.org (Postfix) with ESMTP id AF6D421B1007; Thu, 3 Nov 2011 08:01:54 -0400 (EDT)
Received: from IMCMBX01.MITRE.ORG ([169.254.1.57]) by IMCCAS03.MITRE.ORG ([129.83.29.80]) with mapi id 14.01.0339.001; Thu, 3 Nov 2011 08:01:54 -0400
From: "Miller, Timothy J." <tmiller@mitre.org>
To: Kyle Hamilton <kyanha@kyanha.net>
Thread-Topic: [pkix] An alternative proposal Was: Fwd: New Version Notification for draft-hamilton-cmr-00.txt
Thread-Index: AQHMmOR+3o6yhaO2SES0DD1Qj9f8npWZbmMAgADWC4CAALnHAA==
Date: Thu, 03 Nov 2011 12:01:54 +0000
Message-ID: <CAD7EC92.1FBD%tmiller@mitre.org>
In-Reply-To: <guiqzn5a187ivcfzdyjezwJv4X.penango@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/14.13.0.110805
x-originating-ip: [172.31.62.101]
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg="sha1"; boundary="B_3403148514_9848185"
MIME-Version: 1.0
Cc: "pkix@ietf.org" <pkix@ietf.org>
Subject: Re: [pkix] An alternative proposal Was: Fwd: New Version Notification for draft-hamilton-cmr-00.txt
X-BeenThere: pkix@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: PKIX Working Group <pkix.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/pkix>, <mailto:pkix-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/pkix>
List-Post: <mailto:pkix@ietf.org>
List-Help: <mailto:pkix-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/pkix>, <mailto:pkix-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 03 Nov 2011 12:02:00 -0000

On 11/2/11 2:56 PM, "Kyle Hamilton" <kyanha@kyanha.net> wrote:

>No, it won't, not if the CA's hardware was induced to do something that
>wasn't authorized.

If the CA is compromised, the game is over and whitelisting won't save it.
 A compromised CA will generate false CRLs and whitelists equally well.

-- T

v2.23.0 | Report a Bug | By Email