[cryptography] How much does it cost to start a root CA ?

2013-01-04 Thread John Case
Let's assume hardware is zero ... it's a really variable cost, so I assume (correct me if I'm wrong) that it is a trivial cost compared to legal and audit costs, etc. So what does it cost to start a root CA, get properly audited (as I see the root CAs are) and get yourself included into, say

Re: [cryptography] How much does it cost to start a root CA ?

2013-01-04 Thread yersinia
On Fri, Jan 4, 2013 at 8:41 PM, John Case wrote: > > Let's assume hardware is zero ... it's a really variable cost, so I assume > (correct me if I'm wrong) that it is a trivial cost compared to legal and > audit costs, etc. > > So what does it cost to start a root CA, get properly audited (as I se

Re: [cryptography] How much does it cost to start a root CA ?

2013-01-04 Thread John Case
On Fri, 4 Jan 2013, yersinia wrote: Finally, it seems to me that since there re so few root CAs (~30 ?) and the service provided is such an arbitrary, misunderstood one, that existing CAs would be actively trying to prevent new entrants ... and establish themsevles as toll collectors with a pse

Re: [cryptography] How much does it cost to start a root CA ?

2013-01-04 Thread Patrick Mylund Nielsen
There aren't a lot of root CAs, but there is a very large number of intermediary CAs. The problem is every one of them has the same power to sign certificates for anything/any domain. On Fri, Jan 4, 2013 at 3:01 PM, yersinia wrote: > On Fri, Jan 4, 2013 at 8:41 PM, John Case wrote: > > > > Let

Re: [cryptography] How much does it cost to start a root CA ?

2013-01-04 Thread Greg Rose
You could ask the folks at CAcert... I imagine Ian Grigg will also chime in. Certification costs a lot, and as you have observed, the incumbents try very hard to keep you out. Despite some reasonable sources of funding, CAcert still didn't succeed. Greg. On 2013 Jan 4, at 11:41 , John Case wro

Re: [cryptography] How much does it cost to start a root CA ?

2013-01-04 Thread John Case
On Fri, 4 Jan 2013, Greg Rose wrote: You could ask the folks at CAcert... I imagine Ian Grigg will also chime in. Certification costs a lot, and as you have observed, the incumbents try very hard to keep you out. Despite some reasonable sources of funding, CAcert still didn't succeed. Well

Re: [cryptography] How much does it cost to start a root CA ?

2013-01-04 Thread Ryan Sleevi
On Fri, January 4, 2013 12:59 pm, Greg Rose wrote: > You could ask the folks at CAcert... I imagine Ian Grigg will also chime > in. Certification costs a lot, and as you have observed, the incumbents > try very hard to keep you out. Despite some reasonable sources of funding, > CAcert still did

Re: [cryptography] How much does it cost to start a root CA ?

2013-01-04 Thread James A. Donald
On 2013-01-05 8:05 AM, Ryan Sleevi wrote Can you explain how, exactly, incumbents leverage any power to keep new entrants out? Such behavior is necessarily a deviation from official truth, from the way certification is supposed to work, thus the only way to observe such behavior would be if e

Re: [cryptography] How much does it cost to start a root CA ?

2013-01-04 Thread Ryan Sleevi
On Fri, January 4, 2013 3:06 pm, James A. Donald wrote: > On 2013-01-05 8:05 AM, Ryan Sleevi wrote > > Can you explain how, exactly, incumbents leverage any power to keep new > > entrants out? > > Such behavior is necessarily a deviation from official truth, from the > way certification is suppo

[cryptography] another cert failure

2013-01-04 Thread dan
you may have already seen this, but http://www.bbc.co.uk/news/technology-20908546 Cyber thieves pose as Google+ social network The lapse let cyber thieves trick people into thinking they were on Google+ Continue reading the main story Related Stories Cyber-warriors join treasure hunt Insecure w

Re: [cryptography] How much does it cost to start a root CA ?

2013-01-04 Thread Morlock Elloi
Correct. The cost of being CA is equal to the cost of getting CA signing pub key into the target audience browsers. You can (sorted by increasing security, starting with zero): 1 - go through browser vendors, 2 - have your users to install additional CA key into their existing browsers (and pe

Re: [cryptography] How much does it cost to start a root CA ?

2013-01-04 Thread Peter Gutmann
John Case writes: >So what does it cost to start a root CA, get properly audited (as I see the >root CAs are) and get yourself included into, say, firefox or chrome ? The rule of thumb I've seen from various inside sources is about $1M [0]. Obviously this can vary quite a lot based on whether yo

Re: [cryptography] another cert failure

2013-01-04 Thread Jeffrey Walton
On Fri, Jan 4, 2013 at 6:40 PM, wrote: > > you may have already seen this, but > > http://www.bbc.co.uk/news/technology-20908546 > > Cyber thieves pose as Google+ social network > > The lapse let cyber thieves trick people into thinking they were > on Google+ Continue reading the main story Relat

Re: [cryptography] another cert failure

2013-01-04 Thread Ryan Hurst
FYI the article was changed post Dans mail and no longer contains the unsubstantiated references to malicious use quoted in the bellow. Ryan Sent from my phone, please forgive the brevity. On Jan 4, 2013, at 8:30 PM, Jeffrey Walton wrote: > On Fri, Jan 4, 2013 at 6:40 PM, wrote: >> >> you