4 ms·
I would say PKI (and especially the associated X509 standards) is by far the least understood (or most misunderstood) part of actually building secure stuff. I
by jpgvm 5y ago
I would say PKI (and especially the associated X509 standards) is by far the least understood (or most misunderstood) part of actually building secure stuff.
It would be nice if there was a dummies guide but I'm not really aware of one. Doesn't help that most of "how to PKI" on the web amounts to a bunch of unexplained cryptic openssl CLI incantations.
- dfox 5y agoIt is combination of two things. X.509 is arguably overly complex ASN.1/X.500 thing, but that is not the main issue. Main issue is that most people do not even grasp the concept of a certificate (ie. binding of public key to some additional information that is signed by some other entity).
- raxxorrax 5y agoAlso it is a moving space. Browsers don't accept a single certificate for a site anymore, you also have to have that signed by a CA. You can create such a certificate yourself too, but as of today you will need at least two certificates for browsers to fully accept a TLS secured connection. It hasn't been that long since that rule is in place. So it isn't only the technicalities of asynchronous encryption, there is also specific behavior of applications that use certificates to prove identities.
- brandonmenc 5y agoI recommend Security without Obscurity: A Guide to PKI Operations by W. Clay Epstein and Bulletproof TLS and PKI by Ivan Ristić. I started working in this space a year ago (I'm on a project deploying zero trust networking at a large company) and these books have been invaluable. https://www.amazon.com/gp/product/036765864X https://www.amazon.com/gp/product/036765864X https://www.feistyduck.com/books/bulletproof-tls-and-pki/ https://www.feistyduck.com/books/bulletproof-tls-and-pki/