[cap-talk] PKI considered harmful <--> TTPs are security holes
iang at systemics.com
Thu Feb 24 21:08:15 EST 2005
Nick Szabo wrote:
>Single points of failure are a substantial flaw. See
>"Trusted Third Parties Are Security Holes",
Thanks for that ... I have updated my working review
of PKI problems _PKI considered harmful_ with this
It's not the first time I've come across the complaint,
but it's so far the only reference I have to it, and I
needed jogging to add the section!
A couple of comments on your essay.
TTP Minimizing Protocols - this section does not
include mention of opportunistic methods of
avoiding TTPs. Especially, the SSH family is by
far and away the most successful security protocol
that I am aware of, due to its careful choice of
weaknesses and strengths, aligned to the threat.
OpenPGP's Web of Trust might also merit a comment,
although it has been less successful to date.
"A good digital security protocol designer is not only an expert in
computer science and cryptography, but also very knowledgeable about the
traditional costly techniques of physical security, auditing, law, and
the business relationships to be secured. This knowledge is not used to
substitute these costly security methods for more cost effective digital
security, but in order to minimize hidden dependence on costly methods
for the real security. A good protocol designer also designs, rather
than merely assumes, TTPs that work with minimal use of costly techniques."
resonates with the fc7 message of:
News and views on what matters in finance+crypto:
More information about the cap-talk