Full Disclosure: Re: The merits and uses of CAs

[Valdis.Kletnieks () vt edu]

On Mon, 05 Jan 2009 23:55:59 GMT, Christopher Pritchard said:
> previous certificate became invalid (for example due to a date issue). It
> should also be possible to have semi-centralised CRLs that browsers would
> check for occasions when the server admin wants to change certificates, they
> could post the old one up on the list and the browser wouldn't warn when a
> new certificate is presented.
Something to consider:  In most cases, the CRL that you are supposed to check
to see if a cert has been revoked is listed *in the cert you're checking*.
That's all fine and dandy if you're dealing with a legitimate CA that's
revoking a cert for good reason.  However, it is interesting to consider
what happens when a dodgy CA issues a cert - they have some good reasons
to point the CRL at never-never land.

So - if you were a miscreant running a dodgy CA, where would *you* point
the CRL?

If you were a browser designer, what would you do if you found a CRL that
pointed nowhere?  One option is to not allow the use of a cert that you can't
contact the CRL - except that becomes a massive single point of failure. If
users can't do their home banking because their bank's CA is unreachable due
to severe backhoe fade, they won't be very happy with their browser.

Attachment: _bin
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/