RE: [caops-wg] Name Constraints - attempt at framing issues
If CA1's key is also used to forge a certificate for Brett (even though this is outside what CA1 such be signing). Are we concerned about the additional threat that the forged Brett certificate could also be used by the entity that compromised CA1 to further compromise the relying party?
Thanks very much for the description. I really have trouble believing that anyone would believe that brett or even brett@isp.net if identified by a certificate from CA1 would have any relationship to the same name appearing in acertificate from CA2. (In the case of the "email-like" address it depends on (1) the security of the email system ... for instance mindspring doesn't have a secure IMAP or POP option so I've just been sitting thru a conference where a few people's passwords are broadcast on the wireless network in clear text every 10-15 minutes ... (2) the policy of the isp about reuse of ids ... if the user with the email name brett leaves, can I have that id now? Bob
Cowles, Robert D. wrote:
I really have trouble believing that anyone would believe that brett or even brett@isp.net if identified by a certificate from CA1 would have any relationship to the same name appearing in acertificate from CA2.
Dear Bob I am one of those who think they should refer to the same entity. David (In the case of the "email-like" address
it depends on (1) the security of the email system ... for instance mindspring doesn't have a secure IMAP or POP option so I've just been sitting thru a conference where a few people's passwords are broadcast on the wireless network in clear text every 10-15 minutes ... (2) the policy of the isp about reuse of ids ... if the user with the email name brett leaves, can I have that id now?
Bob
-- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick@kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************
participants (2)
-
Cowles, Robert D. -
David Chadwick