Subject: Re: [xmpp] DNA/S2S Part 2: Authentication

From: Alexander Holler <[email-masked]>
Date: Fri, 09 Sep 2011 11:10:23 +0200

Am 18.07.2011 12:32, schrieb Dave Cridland:

> I wouldn't want to abandon DNSSEC entirely - I think it's a sensible
> direction, and although "CA's are free these days", there is a certain
> degree of getting what one pays for, and it seems to me that DNSSEC
> should dilute in this manner to a lesser degree.

Regarding the current mess with CAs I would prefer every solution which 
doesn't need a certificate.

It looks like that "CA's are free these days" has had some impact on the 
QA of them.

Nobody asked me directly, but I think I should throw in my general 
dislike of certificates you can't control yourself into this discussion. ;)

Regards,

Alexander

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 12 Sep 2011 15:43:50 -0600

> doesn't need a certificate.

Not every certificate is CA-issued.

> It looks like that "CA's are free these days" has had some impact on the

That depends on the CA.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Alexander Holler <[email-masked]>
Date: Tue, 13 Sep 2011 06:41:13 +0200

> Not every certificate is CA-issued.

Yes, therefore I've written that in last sentence you haven't quoted 
"certificates you can't control yourself". ;)

>> It looks like that "CA's are free these days" has had some impact on the

Sure, but the problem with the system used for SSL is that one untrusted 
(or hacked) CA is enough to disable the whole system.

E.g. take two CAs from two countries which doesn't like each other. How 
should a third party handle that case? To make both countries happy you 
would have to disable certificates for domains (and more) from country A 
issued by the CA in country B (and vice versa). And that doesn't only 
affect the two countries, every third party can't trust certificates for 
domains in country A issued by the CA in country B.

Regards,

Alexander

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 13 Sep 2011 09:30:42 -0600

> domains in country A issued by the CA in country B.

This is an interesting discussion, but off-topic for the XMPP WG. Here's
a list where such things are on-topic and actively being discussed:

http://lists.randombit.net/mailman/listinfo/cryptography

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Alexander Holler <[email-masked]>
Date: Tue, 13 Sep 2011 15:19:53 +0200

> domains in country A issued by the CA in country B.

Just to make that clear: It doesn't have to be a problem of the CAs and 
I didn't want to say that most CAs are having bad QA. In fact I think 
and hope most CAs are trustworthy.

But e.g. in the case with the two countries, both CAs are operating 
under the laws of their country. And almost any country has some laws 
which gives the government some rights to do things people outside (or 
even inside) that country don't necessarily like.

And SSL just misses a link from service providers to CAs (or) 
certificates. How to know which CAs or certificates are trusted by the 
service you want to reach?

I know it's (currently) a difficult question and I don't expect an 
answer. To get to the roots, I think a solution might be to use the DNS 
to solve that problem. You have to trust the DNS, otherwise you can't 
reach the remote service (at least not when operating with domain 
names). So if you (have to) trust whatever you get through the DNS ...

But I don't want to elaborate this here more. ;)

Regards,

Alexander