3 ms·

> "The use of TLS for QUIC does not imply or require the use of the Web PKI" Handling certificate revocations (which would be needed to "ensure security"), doe

> "The use of TLS for QUIC does not imply or require the use of the Web PKI" Handling certificate revocations (which would be needed to "ensure security"), does indeed imply the use of some way to check for the revocations in a timely manner. The revocation lists themselves can be tampered-with.

tialaramex 4y ago
You've jumped from assuming the Web PKI, which isn't required, to assuming online revocation checks, which is even more not required.
- csmpltn 4y ago
  So how does your imaginary version of a transport-layer guarantee a message can't be tampered with if it trusts keys which are revoked?
  - ric2b 4y ago
    Web PKI is not the only way to revoke keys.
    - csmpltn 4y ago
      > "Web PKI is not the only way to revoke keys." You're not answering my question (we both know why), and I never mentioned anything about WebPKI in any of my comments anyways.