Re: [pkix] New draft-ietf-pkix-rfc2560bis-06

["Miller, Timothy J." <[e-mail]>]

> X.509/PKIX is defective because it breaks badly already on fraudulent
> cert issuance (a weaker form of CA compromise) and can not cope at all
> with CA key compromise.

Do you have an alternative to the technology, because AFAICT, no PKI standards recover well from a breach of trust.  Even the web of trust has issues; if a well-connected introducer is compromised, all descendent keys become suspect--which can potentially encompass all nodes in the graph.  This can be as devestating as a CA compromise, and would likewise require a re-execution of a large number of signing ceremonies.

> The flaw with CRLs and OCSP is that it tries to infer, from a lack
> of a revocation, that a certificate has been properly issued and is valid.
> Evidently, this turned out to be a logical fallacy with respect to
> real world usage scenarios.

Absent a trusted observer, there is no positive statement that can be issued by a CA that positively identifies only "valid" certificates.  Given a trusted observer, why not make him the CA and be done with it?

-- T