On Sun, Nov 17, 2013 at 5:12 PM, Masataka Ohta <mohta@xxxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
Theodore Ts'o wrote:That being said, the problem for PKI is that, assuming active
> For example, using D-H with no attempt to authenticate the endpoints
> means does not protect you against an active attacker who is carrying
> out a MITM attack.
MITM attacks both on ISP chains and CA chains, it offer no
better security than DH,
As DH involves end systems only, there is no point of deploying
PKI with no additional benefits.
If we assume that the attack model is flying horses armed with lasers there is no additional benefit.
The point is not what the consequences of the assumptions are, the question is how likely the assumptions are. If you leave that out of the equation then the result is nonsense.
Website: http://hallambaker.com/