Re: OpenID/Debian PRNG/DNS Cache poisoning advisory

[Nicolas Williams <Nicolas.Williams () sun com>]

On Fri, Aug 08, 2008 at 12:35:43PM -0700, Paul Hoffman wrote:
> At 1:47 PM -0500 8/8/08, Nicolas Williams wrote:
> > On Fri, Aug 08, 2008 at 02:08:37PM -0400, Perry E. Metzger wrote:
> > > The kerberos style of having credentials expire very quickly is one
> > > (somewhat less imperfect) way to deal with such things, but it is far
> > > from perfect and it could not be done for the ad-hoc certificate
> > > system https: depends on -- the infrastructure for refreshing all the
> > > world's certs every eight hours doesn't exist, and if it did imagine
> > > the chaos if it failed for a major CA one fine morning.
> >
> > The PKIX moral equivalent of Kerberos V tickets would be OCSP Responses.
> >
> > I understand most current browsers support OCSP.
>
> ...and only a tiny number of CAs do so.

Not that long ago nothing supported OCSP.  If all that's left (ha) is
the CAs then we're in good shape.  (OCSP services can be added without
modifying a CA -- just issue the OCSP Responders their certs and let
them use CRLs are their source of revocation information.)