News for hackers. Stuff that matters.

A comment on Launching in 2015: A Certificate Authority to Encrypt the Entire Web. Parent comment

Re:Launching in 2015: A Certificate Authority to Encrypt the... by schoen on Tuesday November 18, 2014 @01:31PM (#8625393)
Well, the best example I know of is proposals to do opportunistic upgrades from HTTP to HTTPS, for example via a browser header in the HTTP reply. If the browser performs the opportunistic upgrade, and negotiates an HTTPS connection behind the scenes, and doesn't tell the user that the connection was served over HTTPS, then accepting a self-signed cert invisibly in this context makes the user no worse off than not performing the upgrade (and better off against an adversary who's not currently performing an active attack).

I forgot what the current status of drafts proposing this is. Amazingly, I found that Rohit Khare described a form of this mechanism way back in 1998 (so it's not a super-new concept).

[ Parent | on HN ]
Re:Launching in 2015: A Certificate Authority to Encrypt the... by kaoD on Tuesday November 18, 2014 @01:35PM (#8625420)
Although such scheme is indeed safer than HTTP (protects against passive attacks), what you're describing is not self-signed certificates, but merely encryption (with new random _unathenticated_ keys per session).

Keys would be exchanged via Diffie-Hellman as usual, but a certificate wouldn't be involved since it's useless anyways (you can't certify anything in such a scheme, why bother at all?) and thus would be vulnerable to active attacks.

Certificates imply long-term authentication. It's an important nuance since they are long-lived by definition, so they have to be trusted and revoked as needed, in which case we're still facing the problem I mentioned earlier.

[ Parent | on HN ]
Re:Launching in 2015: A Certificate Authority to Encrypt the... by schoen on Tuesday November 18, 2014 @02:02PM (#8625628)
I agree that the certificates don't serve any useful function in this scenario; they might be required pro forma, but they aren't actually doing anything helpful.
[ Parent | on HN ]