IETF Logo Mail Archive

Re: [therightkey] DNSNMC deprecates Certificate Authorities and fixes HTTPS security

Stephen Farrell <stephen.farrell@cs.tcd.ie> Fri, 03 January 2014 17:18 UTC

Return-Path: <stephen.farrell@cs.tcd.ie>
X-Original-To: therightkey@ietfa.amsl.com
Delivered-To: therightkey@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E3F3C1ADFEF for <therightkey@ietfa.amsl.com>; Fri, 3 Jan 2014 09:18:38 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.438
X-Spam-Level:
X-Spam-Status: No, score=-2.438 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.538] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zhblC6HB2krW for <therightkey@ietfa.amsl.com>; Fri, 3 Jan 2014 09:18:36 -0800 (PST)
Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) by ietfa.amsl.com (Postfix) with ESMTP id 9E6B01ADFDC for <therightkey@ietf.org>; Fri, 3 Jan 2014 09:18:36 -0800 (PST)
Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 76F60BE58; Fri, 3 Jan 2014 17:18:28 +0000 (GMT)
Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 18j+j2PCpmvL; Fri, 3 Jan 2014 17:18:28 +0000 (GMT)
Received: from [134.226.36.180] (stephen-think.dsg.cs.tcd.ie [134.226.36.180]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 58952BE20; Fri, 3 Jan 2014 17:18:28 +0000 (GMT)
Message-ID: <52C6F0E4.8010501@cs.tcd.ie>
Date: Fri, 03 Jan 2014 17:18:28 +0000
From: Stephen Farrell <stephen.farrell@cs.tcd.ie>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0
MIME-Version: 1.0
To: Carl Wallace <carl@redhoundsoftware.com>, Ralph Holz <holz@net.in.tum.de>, Leif Johansson <leifj@mnt.se>, therightkey@ietf.org
References: <22429D73-4EFC-4091-8F5B-BAD38968EA54@taoeffect.com> <CAMm+LwiMXdEnHqD0y_S-fP6081Tk=A=7-9LsJQhRuawmmmfdTg@mail.gmail.com> <FEFA307D-97E0-4C58-AB43-5B9AB8E8FC70@taoeffect.com> <CAMm+Lwjwww28tV_qvqQVH3xo1xqvjb6z++258+LOqgxWn-Oh9w@mail.gmail.com> <52B88104.9040607@appelbaum.net> <52C2D54F.8000209@comodo.com> <52C45CDC.5020608@appelbaum.net> <96EF8E55-5860-4534-B370-83395C3985D4@vpnc.org> <52C5B67D.4050301@appelbaum.net> <A8E9A208-35FA-495F-8130-C08545011B59@vpnc.org> <52C6A819.4040509@mnt.se> <52C6B9F9.7010304@net.in.tum.de> <52C6C966.3090606@mnt.se> <52C6EF76.4090106@net.in.tum.de> <CEEC5A24.C9BE%carl@redhoundsoftware.com>
In-Reply-To: <CEEC5A24.C9BE%carl@redhoundsoftware.com>
X-Enigmail-Version: 1.6
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
Subject: Re: [therightkey] DNSNMC deprecates Certificate Authorities and fixes HTTPS security
X-BeenThere: therightkey@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <therightkey.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/therightkey>, <mailto:therightkey-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/therightkey/>
List-Post: <mailto:therightkey@ietf.org>
List-Help: <mailto:therightkey-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/therightkey>, <mailto:therightkey-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 03 Jan 2014 17:18:39 -0000

<list moderator hat on>

Folks - Phill is right that the subject line here is wrong.

Please fix if there's more to be discussed on this topic.

And I'd welcome some more discussion on CT and the proposal
to form a WG. Some drafts would be even better!

S.

On 01/03/2014 05:15 PM, Carl Wallace wrote:
> On 1/3/14, 12:12 PM, "Ralph Holz" <holz@net.in.tum.de> wrote:
>> Tell me something new. ;-) Although in fact, the whole thing goes much
>> deeper. A broken hash algorithm means root cert-like compromise as it
>> means the capacity to imitate a correct signature by a root cert. There
>> is no fix for this but blacklisting. Not in any model with TTPs, by the
>> way.
> 
> You mean blacklisting the algorithm, right?
> 
> 
> _______________________________________________
> therightkey mailing list
> therightkey@ietf.org
> https://www.ietf.org/mailman/listinfo/therightkey
> 
>

v2.23.0 | Report a Bug | By Email