Tag Info

New answers tagged

0

No, or at least, not for any robust user authentication mechanism. (Admittedly, the certificate almost certainly contains more entropy than a typical user password, but that's not the point here.) Without a key, the decryption and signing operations cannot be performed, these are critical to X.509. An analogy might make it clearer: compared to a username ...


1

What you describe is unworkable. Without rewriting the SSL implementation on the client and the server, the client must have the private key for the exchange. The authentication comes from using CN as the identifier for the user - hence for webservers it contain the IP name of the server. For authenticating email addreses, the CN contains the ADDR_SPEC. ...


3

As far as X.509 is concerned, there is absolutely no problem in having several certificates with the same public key. The validation process is described in full details here; in a nutshell, it is verified that: each certificate in the chain is currently valid (with regards to its start and end dates for validity); the signature on each certificate is ...


1

All root CAs are self-signed. Which means we feel forced to implicitly trust that the CA is operated responsibly and securely. This isn't always the case (Diginotar). There are alternatives to the certificate authority method. One of these is the web of trust, which is used mainly in PGP / GPG / OpenPGP implementations. There are situations that can arise ...


2

I can think of many reasons. The first one, is economical. Effectively, getting a certification is costly, and the higher you are on the chain, the more expensive it gets. Using, what you propose might theoritically be interesting, but it will cost twice as much to companies (don't forget, CA are economical entities that sell their services, they won't do it ...



Top 50 recent answers are included