4 ms·
> Onion sites also derive cryptographic security from the onion name itself. (I'm working on getting them to be allowed to have DV certs, Is it possible to der
by a1369209993 8y ago
> Onion sites also derive cryptographic security from the onion name itself. (I'm working on getting them to be allowed to have DV certs,
Is it possible to derive a fully secure HTTPS-or-equivalent connection purely from the site's curve25519 key? It seems like that would make DV (and CAs in general) completely redundant. (And if not, is there a explanation of why not?)
- Boulth 8y agoThat's basically what onion addresses v3 are.
- schoen 8y agoI wrote an explanation about why not in https://cabforum.org/pipermail/public/2017-November/012451.html https://cabforum.org/pipermail/public/2017-November/012451.h... See the section "Why do people want certificates for onion names?". It's correct that both v2 and v3 onions provide end-to-end encryption based on the onion service key. In v3 onions that encryption uses more modern cryptographic primitives than in v2 onions, so the incremental cryptographic benefit would be much larger in v2, where unfortunately for historical reasons the CA industry is reluctant to allow DV certs.