Re: [Uta] opportunistic keying / encryption considered of dubious value

["Christian Huitema" <[e-mail]>]

> Personally I have never understood why connecting to a site with a bad
> certificate shows me a warning, while visiting a site over HTTP does
> not.

That's probably the hardest part of the "opportunistic encryption" effort.
The user interface that you describe was developed in accordance to the
principles of PKI, for which the norm is a valid certificate signed by an
approved authority. We know that these principles lead to severe deployment
issues. There is of course the financial cost of paying for the certificate,
but that's probably not the biggest problem. There is a cost in installing a
certificate on a web server. Having an expiration date in the certificate
forces periodic administrative action that are cumbersome for small sites,
and have occasionally tripped large sites. If a site wants to switch to a
longer key, they need a new certificate, yet another cumbersome process. And
then there is the whole issue of authorities being able to spoof
certificate.

We know all that, but at the same time we do not have yet a good
alternative. How does a  client distinguish between a legitimate self-signed
certificate and a clumsy man-in-the-middle attack? If a client sees an
expired certificate, how does it distinguish between a lazy administrator
and an attacker reusing an expired and possibly compromised certificate? If
we can answer these questions, and agree on better user interface
guidelines, then we can possibly reduce the friction associated with the
deployment of TLS in small sites.

-- Christian Huitema