News for hackers. Stuff that matters.

A comment on Now I understand why almost no one uses encrypted email. Parent comment

Re:Now I understand why almost no one uses encrypted email by austincheney on Thursday April 16, 2020 @06:16PM (#22894129)
> Sorry, what's your source?

https://en.wikipedia.org/wiki/Transport_Layer_Security#Algor...

Yes, the Let's Encrypt certificates are valid for only 90 days.

> whose keys 1) are distributed to all major browsers and/or operating systems

Not exactly. Root certificates are widely distributed to user-agent applications but the actual website certificates are available upon request from visiting the sites. A CA is an issuing authority for certificates. Certificates are not directly a component of encryption, but serve to validate the encryption is trusted.

* https://en.wikipedia.org/wiki/Root_certificate

* https://en.wikipedia.org/wiki/Certificate_authority

* https://en.wikipedia.org/wiki/Public_key_certificate

* certificate distribution schemes - https://www.ics.uci.edu/~keldefra/teaching/fall2016/uci_comp...

[ Parent | on HN ]
Re:Now I understand why almost no one uses encrypted email by dredmorbius on Thursday April 16, 2020 @08:40PM (#22895112)
Again, there's nothing in the Wikipedia link which specifies that site certificates MUST exist for a specific duration. Because there's no such requirement in RFC 8446 4.4.2.2, "Server Certificate Selection":

https://tools.ietf.org/html/rfc8446#section-4.4.2.2

If you have information otherwise please do us both the favour of quoting the relevant language from an authoritative source directly in your reply.

You're also creating a dispute based on a claim I've not made. CA keys being "distributed to all major browsers and/or operating systems", my claim, which you quote, does not preclude other distribution mechanisms. That discussion is unnecessary here.

Your understanding, generally, seems in error.

Again: TLS sever keys have no minimum duration requirement, as the Let's Encrypt description previously cited makes explicitly clear: "renewal can take place at any time".

[ Parent | on HN ]
Re:Now I understand why almost no one uses encrypted email by austincheney on Thursday April 16, 2020 @10:29PM (#22895673)
> Again, there's nothing in the Wikipedia link which specifies that site certificates MUST exist for a specific duration.

I never said anything like that. Web certificates are around for as long as both the website and CA are willing to service them.

[ Parent | on HN ]
Re:Now I understand why almost no one uses encrypted email by dredmorbius on Friday April 17, 2020 @09:15AM (#22898683)
"Websites require long term certificate retention and every year or two those certificates are replaced just like email PKI keys are"

https://news.ycombinator.com/item?id=22893385

[ Parent | on HN ]
Re:Now I understand why almost no one uses encrypted email by austincheney on Friday April 17, 2020 @12:32PM (#22900434)
CAs generally issue certificates to websites for 1 or 2 years, but there isn't a fixed duration imposed by cryptography standards. Sometimes the certificates are rejected prematurely due to compromise, and there is a process for that called key revocation.

I am thinking you reading something more into what I wrote than the words on the screen.

[ Parent | on HN ]
Re:Now I understand why almost no one uses encrypted email by dredmorbius on Friday April 17, 2020 @12:56PM (#22900707)
there isn't a fixed duration imposed by cryptography standards

Which was my point in the first place.

A distinct difference from the case of data-at-rest.

I am thinking you reading something more into what I wrote than the words on the screen.

I disagree, but suggest the same for yourself.

[ Parent | on HN ]