2 ms·
> It's already been established that numerous corruptible parties can break https (e.g. by hacking a cert). * Scandal and investigation when they do, potential
by schoen 8y ago
> It's already been established that numerous corruptible parties can break https (e.g. by hacking a cert).
* Scandal and investigation when they do, potentially leading to removal of trust from an associated CA.
* Easier and easier to detect (recently mandatory disclosure of all publicly-trusted certs https://groups.google.com/a/chromium.org/forum/#!topic/ct-policy/wHILiYf31DE https://groups.google.com/a/chromium.org/forum/#!topic/ct-po... and you can sign up to get alerts when a certificate is logged for a particular domain name).
* Onion sites also derive cryptographic security from the onion name itself. (I'm working on getting them to be allowed to have DV certs, but even without certs, the onion rendezvous protocol confirms that you've reached a party that controls a key specified in the name itself.)
(Someone else mentioned HPKP, which I've also touted in the past as improving HTTPS security, but it seems HPKP enforcement is going away, so we can't necessarily tout it for this purpose anymore...)
- a1369209993 8y ago> Onion sites also derive cryptographic security from the onion name itself. (I'm working on getting them to be allowed to have DV certs, Is it possible to derive a fully secure HTTPS-or-equivalent connection purely from the site's curve25519 key? It seems like that would make DV (and CAs in general) completely redundant. (And if not, is there a explanation of why not?)
- Boulth 8y agoThat's basically what onion addresses v3 are.
- schoen 8y agoI wrote an explanation about why not in https://cabforum.org/pipermail/public/2017-November/012451.html https://cabforum.org/pipermail/public/2017-November/012451.h... See the section "Why do people want certificates for onion names?". It's correct that both v2 and v3 onions provide end-to-end encryption based on the onion service key. In v3 onions that encryption uses more modern cryptographic primitives than in v2 onions, so the incremental cryptographic benefit would be much larger in v2, where unfortunately for historical reasons the CA industry is reluctant to allow DV certs.