Re:SSL certificate lifetimes are going down. Dates proposed....
by Arnt on Tuesday October 15, 2024 @08:54AM
(#41848058)
Others have answered on one level. I want to answer on another.
A few older crypto mechanisms were designed around trusting one thing totally. For example, everything's secure until the end of time provided that the user keeps a private key totally private at all times, with no interruption, ever, and if the user lapses then the overall mechanism breaks really badly.
They were complicated mechanisms held together by a screw made of a metal which was assumed to be infinitely strong.
The current fashion is to trust thing in a more limited way, and to design systems such that they won't blow up spectactularly if something breaks. Being able to revoke keys is part of that, it is a weakness that helps to avoid a really bad weakness.
A few older crypto mechanisms were designed around trusting one thing totally. For example, everything's secure until the end of time provided that the user keeps a private key totally private at all times, with no interruption, ever, and if the user lapses then the overall mechanism breaks really badly.
They were complicated mechanisms held together by a screw made of a metal which was assumed to be infinitely strong.
The current fashion is to trust thing in a more limited way, and to design systems such that they won't blow up spectactularly if something breaks. Being able to revoke keys is part of that, it is a weakness that helps to avoid a really bad weakness.