Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 22 down vote favorite
3

In response to SOPA and a number of high profile security breaches at certficate authourities in 2011, the EFF has released a soverign keys proposal:

https://www.eff.org/deeplinks/2011/11/sovereign-keys-proposal-make-https-and-email-more-secure

As a security community can we see any design flaws and proposed changes in this proposal that we could feedback?

share|improve this question
3  
FYI, the EFF has already started collecting issues on the protocol. As expected, they revolve around DoS attacks on the storage and network resources as well as around the distributed nature of the protocol itself. Distributed protocols are hard -- let alone distributed security protocols, and I think this is where the design will fall down the most. – logicalscope Dec 20 '11 at 0:42
Some of us might even be working on it, but I doubt this website is the right place to post research results and discuss potential flaws of a proposal. – user6373 Dec 20 '11 at 0:51
1  
@e-sushi - although I understand you may be working on it and not able to comment, but encouraging analysis and comment from individuals in the industry has to be a good thing. – Rory Alsop♦ Dec 20 '11 at 9:05
@Rory : that's true, and please don't misunderstand - I am all for it. I just think it's to be noted (as Greg indicated) that there is a centralized place to discuss such things. Discussing potential weaknesses in public isn't always the safe way to do it. That's all. ;) – user6373 Dec 20 '11 at 14:00
@E-sushi Do you have a link to that discussion place? – Rory Alsop♦ Dec 20 '11 at 14:04
show 4 more comments

1 Answer

up vote 1 down vote

this piece bugs me...

In practice, we expect many domains to use a third-party service provider for Sovereign Key management,3 but the domain holders can choose exactly which if any such parties they wish to trust.

So there will be a handful of Sovereign Key Management (SKM) companies similar to the handful of Certificate root companies now. They will charge an exorbidant fee to store your Key for you, and half the websites won't do it. THEN the browsers will (instead of blocking the invalid key) have to default to a "The Sovereign Key for the website you are attempting to access is invalid. Would you like to continue to the website anyway?"

How is this different from what we have now?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.