3 ms·

> If you decentralize the certification process you can have a trust-less system. Okay so with a bit of hand-wavey stuff I'm sure we can make a parallel where

by lucb1e 6y ago

> If you decentralize the certification process you can have a trust-less system. Okay so with a bit of hand-wavey stuff I'm sure we can make a parallel where you also solve world hunger with blockchain and trustless systems where there are no centralized parties that can do bad things. But realistically, how would this work? Whose key will end up signing the TLS certificate for my website? You're not really proposing anything more concrete than "let's move CAs to a blockchain".

dgrin91 6y ago
You're totally right, I basically just said put a CA on a blockchain. There is a lot of handwaving in my short HN comment as I wasn't planning on writing out my full RFC here :). Here is some general thoughts I had on the matter - Placing things on a blockchain is a paradigm shift. Yes you can 'just' do it on a blockchain, but you're likely not taking full advantage of the capabilities you receive. Looking at the TLS signing example - why do we actually need to sign the TLS cert? The purpose of a CA signing a cert today is so that the CA can say a cert is what the CA saw and has not been modified. Well if we put it on a blockchain we know it cant be modified (as this is an inherent property of a blockchain). Instead of asking 'can I verify this cert with the CA pub key' I ask 'can I find this cert on the blockchain'.
- Nursie 6y ago
  It's a proof of identity, as well, because a certificate contains much more than just a public key, it contains names of servers etc. It's the CA saying "I attest that the holder of the private key that matches this certificate has this identity". Under some schemes (see the EiDAS regulations if you have trouble to going to sleep some night soon) that also vouch for company registration numbers, company roles granted within the EU financial system etc etc. I'm not sure how (or why) you would do that with a blockchain.

by lucb1e 6y ago

dgrin91 6y ago

You're totally right, I basically just said put a CA on a blockchain. There is a lot of handwaving in my short HN comment as I wasn't planning on writing out my full RFC here :). Here is some general thoughts I had on the matter - Placing things on a blockchain is a paradigm shift. Yes you can 'just' do it on a blockchain, but you're likely not taking full advantage of the capabilities you receive. Looking at the TLS signing example - why do we actually need to sign the TLS cert? The purpose of a CA signing a cert today is so that the CA can say a cert is what the CA saw and has not been modified. Well if we put it on a blockchain we know it cant be modified (as this is an inherent property of a blockchain). Instead of asking 'can I verify this cert with the CA pub key' I ask 'can I find this cert on the blockchain'.

Nursie 6y ago
It's a proof of identity, as well, because a certificate contains much more than just a public key, it contains names of servers etc. It's the CA saying "I attest that the holder of the private key that matches this certificate has this identity". Under some schemes (see the EiDAS regulations if you have trouble to going to sleep some night soon) that also vouch for company registration numbers, company roles granted within the EU financial system etc etc. I'm not sure how (or why) you would do that with a blockchain.