3 ms·
If somehow the private key of a root CA gets leaked, will that make all devices vulnerable? Also what is stopping a government from getting access to these pri
by 0xakhil 8y ago
If somehow the private key of a root CA gets leaked, will that make all devices vulnerable?
Also what is stopping a government from getting access to these private keys?
- saalweachter 8y agoYes; nothing.
- lvh 8y agoUntil we discover the compromise, yes. We have a few better tools for doing that now, like Certificate Transparency. A number of CAs are effectively under the control of a government: https://ccadb-public.secure.force.com/mozilla/IncludedCACertificateReport https://ccadb-public.secure.force.com/mozilla/IncludedCACert... The CABforum BRs define, de facto, the rules/requirements for being a CA: https://cabforum.org/baseline-requirements-documents/ https://cabforum.org/baseline-requirements-documents/
- gsnedders 8y ago> The CABforum BRs define, de facto, the rules/requirements for being a CA: https://cabforum.org/baseline-requirements-documents/ https://cabforum.org/baseline-requirements-documents/ Note that there have been several ballots which have been won by the CAs against the browsers, after which the browsers have turned around, shrugged, and just enforced the new requirements for their root stores without them becoming CAB BRs. Most obviously this applies to Google and Apple requiring all newly issued certificates to be CT qualified.
- bracewel 8y agoNote that CABF bylaws require a simple majority of browsers to vote positively for a ballot for it to pass, regardless of how CAs vote.