On Tue, Mar 02, 2010 at 06:13:28AM +0900, Masataka Ohta wrote: > Phillip Hallam-Baker wrote: > > > Moving to DNSSEC, regardless of the technical model does not eliminate > > the need for certificates or CAs. The purpose of EV certificates is to > > re-establish the principle of accountability. > > I don't know what EV means, but anything human, including CA, is not > infallible, which is why PKI is insecure. "EV" = Extended Validation certificates. Re-establishing (Establishing?) the concept of accountability, I think, requires more than introduction of EV certificates. Assuming that there is even agreement that they have a more accountable CPS, it also requires removal of the allegedly non-accountable CAs from trust anchor lists. This hasn't happened. There is also the question of the actual effectiveness of EV certificates. Do they really work? Can their indicators be spoofed? And can normal users use their visual cues to actually make informed security decisions? There appears to be a growing body of empirical work that shows that the typical user is unable to make effective security decisions based on certificates and their complex set of indicators (whether they are EV branded or not). Here are a few pointers, which I'm sure many folks on this list are well aware of .. * An Evaluation of Extended Validation and Picture-in-Picture Phishing Attacks ISSN 0302-9743 (Print) 1611-3349 (Online) Financial Cryptography and Data Security, 2007 http://www.adambarth.com/papers/2007/jackson-simon-tan-barth.pdf * Why Phishing Works http://people.seas.harvard.edu/~rachna/papers/why_phishing_works.pdf 2006 * The Emperor's New Security Indicators: An evaluation of website authentication and the effect of role playing on usability studies. http://www.usablesecurity.org/emperor/ May 2007 * Crying Wolf: An Empirical Study of SSL Warning Effectiveness http://www.usenix.org/events/sec09/tech/full_papers/sunshine.pdf July 2009 And the paper I know of that supports the effectiveness of EV: * Extended Validation SSL: Green Address Bar Consumer Research Verisign/Thawte/Tec-Ed study: http://www.verisign.com.sg/guide/ssl-ev/EV-SSL-GreenBarResearch.pdf There have been extensive discussions on this topic on various other lists (cryptography, w3c, etc), and I'm not sure I look forward to seeing all of it rehashed on the IETF list. But I would be interested in pointers to other credible studies on this topic. --Shumon. _______________________________________________ Ietf mailing list Ietf@xxxxxxxx https://www.ietf.org/mailman/listinfo/ietf