-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Peter Gutmann wrote:
...
For example if
I make a CC
purchase from foo.com, I don't trust them because of their
Verisign cert, but
I have no choice but to depend upon them because if I don't I
can't make my
purchase. So PGP's mechanisms propagate trust, X.509's
propagate dependency.
No, X.509 propagates trust. The root certificates in your browser's
certificate store are there because you trust them. I realize that
the browser vendor pre-loads a bunch of certificates. This is to make
things easier for the end user. If you don't trust VeriSign to issue
signatures, remove them from the root certificate store. Now, once
that's done, does the certificate for foo.com appear valid? No.
You've revoked your trust of VeriSign, so it shouldn't. Using the
site is NOT dependent on VeriSign. You can make the SSL connection
without trusting the certificate. Then, it becomes the same
(security-wise) as HTTP; you can't be sure you're avoiding a MITM
attack.
This would be exactly the same if a Linux vendor preloaded
/etc/skel/.gnupg/ with default keys marked as trusted. There is no
dependency introduced, just pre-loaded trust. If you didn't trust the
pre-loaded keys, you could just remove them.
X.509 has its flaws, but it's trust model is in fact based on trust.
It's just different from PGP's Web-of-Trust. If you disagree with it
because it forces you into rigid hierarchies (typically promoted by
commercial interests), fine. But, the underlying technology isn't
creating any sort of trust-like dependency.
A good definition of "trust" in a computer security context is, "An
entity which can break your security policy." (I don't know if this
is attributable to the DoD or whom.) In other words, if you have
VeriSign in your root certificates, they can break your security
policy by issuing a bad certificate. This is not dependence.
Richard Laager
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.2
iQA/AwUBQBsUmm31OrleHxvOEQKAmwCgz2KoZ1S8yqXWk1uSDLvYH1aVBCsAnR0i
L9l/Gcrcx8eLXuDH56bAG3P+
=O1aK
-----END PGP SIGNATURE-----