John Case <c...@sdf.org> writes:
>So what does it cost to start a root CA, get properly audited (as I see the
>root CAs are) and get yourself included into, say, firefox or chrome ?
The rule of thumb I've seen from various inside sources is about $1M [0].
Obviously this can vary quite a lot based on whether you're starting from
scratch or already have secure facilities, vetted staff, etc, so it can go
much higher, but is unlikely to be lower.
>Is inclusion of a root CA in the major browsers a "shall issue" process ? hat
>is, you meet the criteria and you get in ? Or is it a subjective, political
>process ?
There's no bias that I've heard of, you check all the boxes to to confirm that
you've done what the browser vendors require, produce the auditor's OK, and
you're in.
To put it more succinctly, to be a root CA you just need to buy your way in.
I don't mean that in a cynical manner, it's just that that's what the bottom
line is, you need to spend enough money to get in, but if you're prepared to
do that then anyone can get it.
>Finally, it seems to me that since there re so few root CAs (~30 ?) and the
>service provided is such an arbitrary, misunderstood one, that existing CAs
>would be actively trying to prevent new entrants ...
The extreme cost is enough of a barrier to getting in that it deters most new
entrants. If you look at the root CAs that aren't mass-market ones (the
GoDaddy's and so on), they're all boutique CAs with captive markets or
national-prestige ones where cost isn't an object, so the overhead is enough
of a barrier to keep the riff-raff out.
Peter.
[0] In order to address an issue that's also come up with FIPS 140 where I've
said that the cost for a level 1 is $100K and people have claimed it's
much cheaper: If you claim you can get a root cert into all the major
browsers for a lot less than $1M then I'll connect you with people who
will want to get in at the price you quote, so you'll need to be prepared
to put your money where you mouth is. For FIPS 140 I've had an open offer
on my home page for several years now to pay, in cash, the price that some
people have quoted they can get it done for ($30K). So far zero have
taken me up on the offer.
_______________________________________________
cryptography mailing list
cryptography@randombit.net
http://lists.randombit.net/mailman/listinfo/cryptography
