On Thu, 15 Jun 2000, brunet eric wrote:
> hello,
>
> My question is maybe stupid, but how clients obtain CAs public key in
> all confidence??? not via internet I suppose(support unreliable by
> definition)?????
> Thank you for your future answer !)
>
I think this is a question that does not have an adequate general answer.
Obviously the root certs can't be verified via its signature because it is
self-signed. It is commonly said that some "out-of-band" method must be
used. But I have yet to hear a good general method that works well for
widespread or long-distance distribution.
Some possibilities off the top of my head are:
+ personal delivery of the cert by a security officer on
a floppy (maybe in a symmetrically encrypted form) and a
separate personal delivery of the symmetric key and cert
fingerprint for verification. (good for assurance, bad for
long-distance distribution)
+ delivery via an insecure method (like the web or email),
but verification of the signature or hash via a "personally
delivered/assured document" (e.g. your security officer
hand-delivers a cert fingerprint for comparison). (a little
more convenient than the previous)
+ verification via multiple independent registries. The thought
being that it would difficult to "fool" many independent sources.
(not great for assurance and there are no such "registries").
Of course, what lengths you go to depends on the level of assurance you
desire.
I would like to hear what "out-of-band" methods people are using in real
life.
yuji
----
Yuji Shinozaki Computer Systems Senior Engineer
[EMAIL PROTECTED] Advanced Technologies Group
(804)924-7171 Information Technology & Communication
http://www.people.virginia.edu/~ys2n University of Virginia
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
