Not logged in
Log in now
Create an account
Subscribe to LWN
LWN.net Weekly Edition for May 23, 2013
An "enum" for Python 3
An unexpected perf feature
LWN.net Weekly Edition for May 16, 2013
A look at the PyPy 2.0 release
Posted Mar 25, 2010 0:58 UTC (Thu) by foom (subscriber, #14868)
Posted Mar 25, 2010 3:09 UTC (Thu) by martinfick (subscriber, #4455)
Why would the US govt having control over the signing key for .us make
interception easier than them having control of N of the M signing keys
browsers trust for SSL?
Since in one case interception is easy for 100% of the cases that I
specified (US domain traffic), and in the other case, interception is only
easy for a fraction of the US domain, i.e that fraction of the US sites
which are signed by the N US gov. controlled keys.
(I hope you don't think the US Govt somehow lacks the ability to sign
arbitrary SSL certificates...)
Why wouldn't they? Even I can sign any arbitrary key, as long as I can see
it. But what good does it do for them or me for intercepting traffic? It
is only valuable if they/I can sign it with the key of a CA that others
Posted Mar 25, 2010 5:38 UTC (Thu) by foom (subscriber, #14868)
That's not the case. It's easy for *all* sites on the internet, .US domain or not!
As this article points out, all they need is to have control of the private key for *ONE* CA that web
browsers trust, and they can man-in-the-middle every SSL-protected site on the internet.
And, as I tried to say in the message you responded to, I'm pretty certain that some three-letter-
agency in the US govt controls at least one trusted CA private key. Most likely more than one. It
would just be colossally incompetent for them not to have that ability, consider how easy it is to
Posted Mar 25, 2010 6:18 UTC (Thu) by martinfick (subscriber, #4455)
Copyright © 2013, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds