Re: [TLS] TLS, PKI,

[Marsh Ray <[e-mail]>]

On 07/13/2010 08:41 PM, Robert Relyea wrote:
> On 07/13/2010 05:06 PM, Martin Rex wrote:
>>
>> If SSHv1 would have required CA-signed X.509 certs in its initial
>> shipment, it would have taken MUCH longer to become popular, if at all.
>>
> Compared to SSL, SSH is still not popular, which sort of negates your point.
>
> SSL is designed to allow you to make secure connections for the masses.

Specifically it was designed to allow the masses to make secure* 
connections to e-retailers with which they had no prior agreement. 
Having a pre-trusted third party perform the introduction is probably 
the only way to accomplish that. Trust-on-first-use and PGP web-of-trust 
type models were simply not going to get the shoppers online.

*secure = Secure enough to convince people it's safe to type in their 
credit card online, yet not so secure that it presented a real obstacle 
to government decryption.

So be careful what you ask for, those requirements were met and we've 
been living with those design decisions for so long now it's hard to 
have an objective perspective on proposed alternatives.

Who can say why one protocol is considered "secure" in its users' 
opinion? SSHv2 is a nice, cleanly designed protocol. "Why can't SSL just 
work like SSH?" they ask. Yet it's inherently vulnerable to MitM for the 
initial connection and amounts to users installing a permanent exception 
for every cert mismatch warning. The default configuration for many 
clients (including PuTTY) leaves it vulnerable to a trivial downgrade 
attack to SSHv1 which can be vulnerable to plaintext injection. These 
are known issues, but for some reason they are disregarded by those who 
like to think of SSH as some kind of gold standard.

I dislike oligarchies as much (or more) than the next guy, but IMHO we 
actually need more of it in the CA department. I don't want a big 
inclusive society of hundreds of CAs all trusted without limit by my 
browser. I personally believe the appropriate number of CAs for my 
browser is somewhere between 5 and 10. I want just enough to ensure 
reduncancy and allow for some market competition, and no more.

I may "trust" every CA approved by my browser vendor in the sense that I 
estimate with 99% probability that that CA will not act in a way which 
diminishes my effective security. But if I trust 200 of them then my 
estimation of the probability that none will fail me drops to 13% 
(0.99^200).

Of course, based on their observed performance I wouldn't trust many of 
them with a 10 foot pole. :-) Like the one with the login/password form 
on their non-SSL home page (you know who you are).

- Marsh