Re: 0xdeadbeef comes of age: making keysteak with GnuPG

[Werner Koch <wk () gnupg org>]

On Fri, 10 Oct 2014 18:01, coruus () gmail com said:

> My problem with the HKPS pool is that I don't know Kristian.[1] And I
> don't have any reason to believe that he'd suffer serious financial

X.509 is entirely broken and we can't do anything about it.  However, it
gives you some assurance that it is harder to read the requests.  But it
is not really hard, they just need to compromise a few well known
keyservers.  Let's use hkps to raise the surveilance costs - that is
worth the little trouble.

But do not trust any keyserver!  Use your own way to validate the key.

> [2] This is different from saying that I think he *would
> intentionally* sign a malicious cert, which I don't. I just have no
> idea how secure the private key for that CA is. And I know that a
> fully isolated, physically secure facility, and a good HSM are really
> expensive. (But maybe he is doing this?)

Why attacking a certain "high-security" CA if you can easily convice
another of the 1300 (?) primary root CAs to issue a certifciate to your
needs.

BTW: Using a pool with 2.1 will be more reliable because 2.1 tracks
failures of the current server and switches to another one in that
case.  Thus you do not need to rely on the DNS round-robin.


Salam-Shalom,

   Werner


-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.