News for hackers. Stuff that matters.

A comment on If you’re not using SSH certificates you’re doing SSH wrong (2019). Parent comment

Re:If you’re not using SSH certificates you’re doing SSH wro... by jpgvm on Thursday March 24, 2022 @08:55AM (#30789071)
I would say PKI (and especially the associated X509 standards) is by far the least understood (or most misunderstood) part of actually building secure stuff.

It would be nice if there was a dummies guide but I'm not really aware of one. Doesn't help that most of "how to PKI" on the web amounts to a bunch of unexplained cryptic openssl CLI incantations.

[ Parent | on HN ]
Re:If you’re not using SSH certificates you’re doing SSH wro... by brandonmenc on Thursday March 24, 2022 @11:06AM (#30790917)
I recommend Security without Obscurity: A Guide to PKI Operations by W. Clay Epstein and Bulletproof TLS and PKI by Ivan Ristić.

I started working in this space a year ago (I'm on a project deploying zero trust networking at a large company) and these books have been invaluable.

https://www.amazon.com/gp/product/036765864X

https://www.feistyduck.com/books/bulletproof-tls-and-pki/

[ Parent | on HN ]
Re:If you’re not using SSH certificates you’re doing SSH wro... by dfox on Thursday March 24, 2022 @09:00AM (#30789123)
It is combination of two things. X.509 is arguably overly complex ASN.1/X.500 thing, but that is not the main issue.

Main issue is that most people do not even grasp the concept of a certificate (ie. binding of public key to some additional information that is signed by some other entity).

[ Parent | on HN ]
Re:If you’re not using SSH certificates you’re doing SSH wro... by raxxorrax on Thursday March 24, 2022 @10:54AM (#30790727)
Also it is a moving space. Browsers don't accept a single certificate for a site anymore, you also have to have that signed by a CA. You can create such a certificate yourself too, but as of today you will need at least two certificates for browsers to fully accept a TLS secured connection. It hasn't been that long since that rule is in place.

So it isn't only the technicalities of asynchronous encryption, there is also specific behavior of applications that use certificates to prove identities.

[ Parent | on HN ]