OT: problems with the X.509 PKI business [was: Re: Gcrypt-devel Digest, Vol 66, Issue 5]
linux at paip.net
Sun Jul 25 06:41:26 CEST 2010
On Sat, Jul 24, 2010 at 10:07:30PM -0400, Daniel Kahn Gillmor wrote:
> On 07/24/2010 06:37 AM, Milo wrote:
> > On 07/24/2010 10:36 AM, gcrypt-devel-request at gnupg.org wrote:
> >>> A counterpoint would be that the whole X.509 PKI business is entirely
> >>> broken and does not provide any security at all.
> >> agreed, sadly.
> > "whole X.509 PKI business is broken and does not provide any security at
> > all" - very interesting statement. Could you elaborate on that?
> For one example, X.509 sets up a situation that encourages centralized,
> hierarchical reliance on an unaccountable cabal of Certificate Authorities:
It's way, way worse than that. No only are there are over 250 root CAs
that some browsers trust, but those CAs have signed an (unknown!) number
of intermediate certificates, _any_ of which can be used to sign a
certificate for _any_ domain.
See for example
which was presented at HotPETs in Berlin just this past Friday.
More information about the Gcrypt-devel