4 ms·
Presumably a government could also requisition the private key of several root authority certificates (whether or not they "proudly announce" that is another ma
by gigel82 3y ago
Presumably a government could also requisition the private key of several root authority certificates (whether or not they "proudly announce" that is another matter).
- repelsteeltje 3y agoDutch government doesn't have a good reputation there, shepherding control over security infrastructure. First, it's primary CA lost is signing key to Iran, and recently they meant to outsource control over their ".nl" TLD to AWS.
- mrngm 3y agoSmall addendum on that, DigiNotar was one of the four CA's handing out "PKIoverheid" certificates, so certificates for governmental purposes. See this archived copy of the FAQ (in Dutch) after the DigiNotar breach, specifically the question "Hoe weet de overheid dat certificaten van de 3 andere bedrijven in Nederland die PKI-overheidscertificaten uitgeven wel betrouwbaar zijn?": https://web.archive.org/web/20111019224308/http://www.rijksoverheid.nl/documenten-en-publicaties/brochures/2011/09/05/vraag-en-antwoord-over-diginotar.html https://web.archive.org/web/20111019224308/http://www.rijkso...
- amenghra 3y agoA root CA key doesn't automatically decrypt the TLS traffic. You just need a single root CA key for a widely trusted CA to perform an active MITM attack. The attack is however likely to show up in Certificate Transparency logs.