Tag Archives: SSL

Sicherheit der privaten Schlüssel von CAcert-Zertifikaten / Safety of private keys of CAcert-Certificates

[English Version below]

In den Medien[1] wurde jetzt bekannt, dass US-Regierungsbehörden zur Entschlüsselung der verschlüsselten Kommunikation möglicherweise die privaten Schlüssel von Dienstanbietern fordert.

Bei der Zertifikatserstellung mit CAcert-Zertifikaten verlassen die privaten Schlüssel niemals den Rechner des Anwenders und werden damit nicht etwa an CAcert übertragen. CAcert kann deshalb die privaten Schlüssel auch nicht weitergeben. Dadurch stellen Zertifikate von CAcert ein Verfahren dar, mit dem sichere Kommunikation gewährleistet werden kann.

Pressemitteilung Schlüsselsicherheit

[1] http://heise.de/-1924012

[English Version]
Currently US press[1] spreads information that government organizations demand private keys from service providers for decrypting secret communications.

When creating certificates with CAcert, private keys never leave the system of the user, and therefore are not transmitted to CAcert. Hence, private keys cannot be disclosed by CAcert and thus certificates from CAcert provide a means to safeguard a secure communication.

Pressrelease Key Safety

[1] http://news.cnet.com/8301-13578_3-57595202-38/feds-put-heat-on-web-firms-for-master-encryption-keys/

Client Certs are the future…

One of the things I recently discovered (to my surprise) is that client certs used in browsers are out of scope for browser policy purposes. This is because *the server* is the relying party, and there is no decision of reliance to make in the browser. So the vendor doesn’t care.

And, as we know, for the most part servers require a fair bit of config to get up and going … so even a decision to distro the root of one player or another isn’t so important.

The playing field is more or less level. What’s perhaps more controversial is this claim: client certs deliver more bang-for-buck in real security benefits than any other use of certs.

Which means that our idea of using client certs every where (CATS.cacert.org originally, but now webmail, archives, and this very blog!) is also a good strategic direction. We can deliver!

Therefore, Apache tutorials like this one by Dan are much more important. Download it today! Put it into practice on your website! Not to mention, that client certs delivers lots of administration benefits in easing our management of sites, as I muse on over at my blog. Have you noticed how there are no complaints about lost passwords over at CATS.cacert.org? No more comment spam on this blog [1]?

Say No to Spam!

What I would like to see is a list of systems where CAcert certs are now in definite use. Production. Benefits! This would include CATS in pole position, also the blog, the webmail, the mail archives. Also possibly that OpenID server (is that run by Assurers? I assume so… I’m not even sure where it is).

[1] OK, it seems that only a very few long suffering admins could even see it. So you probably can’t see it, … and can’t imagine the joy of not having to deal with it ever again 🙂 I checked last night, there is a tiny bit of trackback spam, which I can’t quite see how to deal with, but nobody cares about trackback these days…

CAcert at mrmcd0x8h (Sep. 4th – 6th)

CAcert will be present at mrmcd0x8h with 2 presentations and a Keysigning party:

Continue reading