Re: [saag] Channel binding is great but not a silver bullet

Without wanting to go too far down this route. 

Yes the approach has merit and one can even imagine a situation in the distant future where this type of approach transforms the role of CAs rendering certain types of low assurance product obsolete. But what you cannot get from that approach alone is a demonstration of accountability which is the cornerstone of the Extended Validation design.

And even if we start right now, such a scheme requires deployment of a whole new infrastructure and a whole new set of applications to run on top of it.

While I certainly hope that it takes the cryptographers as long to turn the SHA1 querry into a full break as it took them to convert the MD5 compromise into a fuill break I do not want to depend on that. And I certainly think that we, the crypto-security community are going to be nervous about the security of SHA1 long before the rest of the industry is.

And even if such an infrastructure was deployed, the CAs wil still be in business selling DV validated certs because there will still be a large number of businesses that make support for legacy browsers a much higher priority than not supporting crypto algorithms that make us nervous. 

________________________________

From: saag-bounces@ietf.org on behalf of Sam Hartman
Sent: Thu 2/26/2009 3:20 PM
To: Nicolas Williams
Cc: der Mouse; saag@ietf.org
Subject: [saag] Channel binding is great but not a silver bullet

Nico, while I'm in favor of channel binding and believe your approach
has a lot of value, please be careful to apply it only where applicable.

Phil is talking about the web browser PKI.  Channel binding to
existing authentication solves some problems in that space, but
definitely not all.  For example it is not useful for securing
enrollment or certain classes of URI-only handoff.

So, I think the web will continue to need a PKI.:-)

_______________________________________________
saag mailing list
saag@ietf.org
https://www.ietf.org/mailman/listinfo/saag