4 ms·
There should be a separation between transport security and brand authenticity, and the latter shouldn't even be part of TLS.
by Rjevski 9y ago
There should be a separation between transport security and brand authenticity, and the latter shouldn't even be part of TLS.
- nailer 9y agoEV is matching a legal entity to a pubkey. Nothing more, nothing less. Brands and trademark ownership don't come into it: it's legal identity only. Let's look at how other cryptosystems match identities to public keys: - Debian/dpkg does it with key signing parties, where people hold up their passports and read out the pubkeys used to sign their packages. From https://wiki.debian.org/Keysigning https://wiki.debian.org/Keysigning : > The people who will sign your key will need to see some form of government issued ID (passport or similar). This is almost the same as the EV process for a sole proprietor. - Email users who use GPG do it by publishing keys in places like keybase or university address books which confirm identity by control of other well known accounts associated with that person - eg, your Twitter handle, or university account associated with your identiy. - SSL/TLS used to do this with phone calls, faxes and YellowPages entries, verifying that all those fields you entered into your CSR were correct, before GeoTrust invented Domain Validation to save themselves a bunch of money. If you don't want to prove who you are, that's fine. But matching identities to pubkeys is a very, very normal part of PKI.