3 ms·

I really dislike the fact that a CA is able to bless a new CA completely independently. Does this cause anyone else the slightest amount of anxiety, or am I jus

by gergles 11y ago

I really dislike the fact that a CA is able to bless a new CA completely independently. Does this cause anyone else the slightest amount of anxiety, or am I just being paranoid?

ColinDabritz 11y ago
It seems like its an important thing to be able to express. They are extending their trust to the new CA. I believe this information is available to clients if they wanted to choose to reject cross signing. You're right that this sort of broad power is scary, but I think it's being used reasonably in this context. Do you have specific concerns you are afraid of? The only problem I thought of was a compromised CA cross-signing a malicious CA, but if they are compromised, you could just issue the main CAs certs anyway.
pugtor 11y ago
IdentTrust is governed by their CP and CPS documents, which specify the criteria for delegating authority.
belorn 11y ago
Whats the alternative to CA being able to delegate signing? Would you prefer having browsers constantly being updated with new lists of CA's, maybe one new per day. Second, would you prefer that browsers blessed a new CA completely independently? If not then who should have that power? Governments? Non-profit organizations like ISRG? The big alternative is to maintain your own list of trusted CA's, going through each and every new CA that you encounter and associate a trust relationship. Not even famous security researchers do this, and I can't really blame them as it is like a lawyer reading every EULA that they encounter and fully investigate the scope of them. The scope and complexity just get beyond what a single person can manage.
- gergles 11y ago
  Yeah, I guess I think it makes more sense for the browser manufacturers to be the people to whom I delegate that responsibility. I already trust them not to run malware on my computer and to accurately display the SSL state of a connection. I just think it's odd that any CA can turn around and make any other random CA fully blessed. It seems like it completely circumvents the browser manufacturers including root CAs at all. Totally agreed re: maintaining your own list of CAs. I mostly do go through the system CA list and disabling any from foreign governments I don't ever plan on trusting, but that's mostly feel-good and not actual security.

by gergles 11y ago

I really dislike the fact that a CA is able to bless a new CA completely independently. Does this cause anyone else the slightest amount of anxiety, or am I just being paranoid?

ColinDabritz 11y ago

It seems like its an important thing to be able to express. They are extending their trust to the new CA. I believe this information is available to clients if they wanted to choose to reject cross signing. You're right that this sort of broad power is scary, but I think it's being used reasonably in this context. Do you have specific concerns you are afraid of? The only problem I thought of was a compromised CA cross-signing a malicious CA, but if they are compromised, you could just issue the main CAs certs anyway.

pugtor 11y ago

IdentTrust is governed by their CP and CPS documents, which specify the criteria for delegating authority.

belorn 11y ago

Whats the alternative to CA being able to delegate signing? Would you prefer having browsers constantly being updated with new lists of CA's, maybe one new per day. Second, would you prefer that browsers blessed a new CA completely independently? If not then who should have that power? Governments? Non-profit organizations like ISRG? The big alternative is to maintain your own list of trusted CA's, going through each and every new CA that you encounter and associate a trust relationship. Not even famous security researchers do this, and I can't really blame them as it is like a lawyer reading every EULA that they encounter and fully investigate the scope of them. The scope and complexity just get beyond what a single person can manage.

gergles 11y ago
Yeah, I guess I think it makes more sense for the browser manufacturers to be the people to whom I delegate that responsibility. I already trust them not to run malware on my computer and to accurately display the SSL state of a connection. I just think it's odd that any CA can turn around and make any other random CA fully blessed. It seems like it completely circumvents the browser manufacturers including root CAs at all. Totally agreed re: maintaining your own list of CAs. I mostly do go through the system CA list and disabling any from foreign governments I don't ever plan on trusting, but that's mostly feel-good and not actual security.