News for hackers. Stuff that matters.

A comment on The State of HTTP in 2022. Parent comment

Re:The State of HTTP in 2022 by tialaramex on Sunday January 01, 2023 @12:12PM (#34208209)
The use of TLS for QUIC does not imply or require the use of the Web PKI which is what I assume you're thinking of by "certificate authorities outside to validate packages".
[ Parent | on HN ]
Re:The State of HTTP in 2022 by csmpltn on Sunday January 01, 2023 @12:52PM (#34208709)
> "The use of TLS for QUIC does not imply or require the use of the Web PKI"

Handling certificate revocations (which would be needed to "ensure security"), does indeed imply the use of some way to check for the revocations in a timely manner. The revocation lists themselves can be tampered-with.

[ Parent | on HN ]
Re:The State of HTTP in 2022 by tialaramex on Sunday January 01, 2023 @04:09PM (#34210908)
You've jumped from assuming the Web PKI, which isn't required, to assuming online revocation checks, which is even more not required.
[ Parent | on HN ]
Re:The State of HTTP in 2022 by csmpltn on Monday January 02, 2023 @12:23AM (#34214654)
So how does your imaginary version of a transport-layer guarantee a message can't be tampered with if it trusts keys which are revoked?
[ Parent | on HN ]
Re:The State of HTTP in 2022 by ric2b on Thursday January 05, 2023 @03:22PM (#34265963)
Web PKI is not the only way to revoke keys.
[ Parent | on HN ]
Re:The State of HTTP in 2022 by csmpltn on Friday January 06, 2023 @03:36AM (#34272407)
> "Web PKI is not the only way to revoke keys."

You're not answering my question (we both know why), and I never mentioned anything about WebPKI in any of my comments anyways.

[ Parent | on HN ]