3 ms·

You're totally right, I basically just said put a CA on a blockchain. There is a lot of handwaving in my short HN comment as I wasn't planning on writing out my

You're totally right, I basically just said put a CA on a blockchain. There is a lot of handwaving in my short HN comment as I wasn't planning on writing out my full RFC here :). Here is some general thoughts I had on the matter - Placing things on a blockchain is a paradigm shift. Yes you can 'just' do it on a blockchain, but you're likely not taking full advantage of the capabilities you receive. Looking at the TLS signing example - why do we actually need to sign the TLS cert? The purpose of a CA signing a cert today is so that the CA can say a cert is what the CA saw and has not been modified. Well if we put it on a blockchain we know it cant be modified (as this is an inherent property of a blockchain). Instead of asking 'can I verify this cert with the CA pub key' I ask 'can I find this cert on the blockchain'.

Nursie 6y ago
It's a proof of identity, as well, because a certificate contains much more than just a public key, it contains names of servers etc. It's the CA saying "I attest that the holder of the private key that matches this certificate has this identity". Under some schemes (see the EiDAS regulations if you have trouble to going to sleep some night soon) that also vouch for company registration numbers, company roles granted within the EU financial system etc etc. I'm not sure how (or why) you would do that with a blockchain.