Re: Online Certificate Revocation Protocol

[pgut001@xxxxxxxxxxxxxxxxx (Peter Gutmann)]

Paul Hoffman / IMC <phoffman@xxxxxxx> writes:

>The latter is probably much more likely. Given that private keys are often 
>(usually?) protected with crackable passwords, the loss of a computer to an 
>attacker can be pretty disastrous. I assume that many CAs have out-of-band 
>revocation mechanisms for this case, but they certainly would take a long 
>time, and are probably difficult for a typical end user to find out about.
 
When I brought this up on the CMP list a while back, the response 
(tongue-in-cheek) was that users are expected to fly to the CA's place of 
business and beg in person to have their cert revoked.  This didn't strike me
as a very workable revocation mechanism.
 
(In case it isn't obvious anyway, I'm firmly in the scram-switch camp).
 
Peter.