On Friday 20 May 2005 23:47, Jean-Marc Desperrier wrote: > Gervase Markham wrote: > > Er, given that we have no OCSP and no-one's checking CRLs, I think > > losing a root cert which is embedded in 99% of browsers out there would > > be an _extremely_ big deal. > > But OCSP/CRL can not help in case of *root* cert compromission. > There's nothing above it to sign the validity information.
Can't it revoke itself? The bottom line with a root key being exposed is much the same as with a browser exploit. For example, the Microsoft certificate blooper where IE wasn't checking up the chain, so anyone could use any cert. So in that case, any browser that has the root cert in its root list then is encouraged to issue a new root list, in an emergency patch. Much like 1.0.4, recently done because of some bug. And perhaps hack in some emergency code that pops up an Infobar when that particular root is seen in the normal course of events. No big deal, at the distro level unless I'm mistaking things dramatically. (Yes, of course, it would be a huge deal reputation- wise, as the press and the critics would slaughter the poor CA ... but there isn't much we can do about the press except explain how this is equivalent to the last 100 exploits that got fixed.) iang -- Advances in Financial Cryptography: https://www.financialcryptography.com/mt/archives/000458.html _______________________________________________ Mozilla-security mailing list Mozilla-security@mozilla.org http://mail.mozilla.org/listinfo/mozilla-security
