[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: threshold subjects
-----BEGIN PGP SIGNED MESSAGE-----
>>>>> "David" == David Black <d.black@opengroup.org> writes:
David> The more general problem is that all keys have to be
David> replaced eventually. Do threshold subjects provide a route
David> for replacing *all* keys (one at a time is ok) -- i.e.,
No. If you replace all keys, then the old certificate is no longer
valid.
The threshold let's one reissue the certificate at *any* time
between the time the original certificate is issued and the *last* key
(of k) is replaced. (clearly, if k keys have been compromised, then
you lose.)
This is still the case for single key CA's (k=n=1), but now there is
no leeway between the first of n keys being compromised, and the k'th
of n being compromised.
] Where's the sun? Oh there you are. Aren't you late today? | one quark [
] Michael Richardson, Sandelman Software Works, Ottawa, ON | two quark [
] mcr@sandelman.ottawa.on.ca http://www.sandelman.ottawa.on.ca/ | red q blue q[
] panic("Just another NetBSD/notebook using, kernel hacking, security guy"); [
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: latin1
Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface
iQB1AwUBNHHDdMmxxiPyUBAxAQHTEwL/RpdoBOKpSRVmyfgSf2SafGJ/v4PNSska
Vf+gJlzkeT374zgl1kgoDLoKraigvPJVinb9F613AksLynBAfXgSrkdiLcfDoChE
Yzc/m5Ixm7NBoNN2ZldQvILESO8nB7ln
=on6I
-----END PGP SIGNATURE-----
References: