little boxes made of words

1. On Mon, Jan 7 at 10pm,
   fluffy said —

   Ostensibly, any app which accepts a self-revocation from the self-signed cert would authorize the cert, then perform the action which is signed with said cert. Ideally such an app would be designed with ACID criteria in mind. So, hopefully, self-signed self-revocation would behave as one would intuitively expect (i.e. a suicide note).
2. On Mon, Jan 7 at 10pm,
   Jens Alfke said —

   But revocations are timestamped, so the cert is already invalid at the time the app is parsing the revocation. It’s exactly like the Liar Paradox.

   There’s a later point in the same slideshow where he describes how revocation means certs can’t obey ACID properties. The whole thing is a great exercise in sustained sarcasm; by the end, X.509 is reduced to a smoking hole in the ground that he’s pouring salt into.
3. On Tue, Jan 8 at 7am,
   fluffy said —

   I guess that depends on how much you’re supposed to trust the timestamp, then, considering that even in a world of NTP time is still fairly relative (and lunchtime doubly-so).
4. On Thu, Jan 10 at 3pm,
   Shamino said —

   It would seem to me that, due to the impossibility of completely synchronizing clocks over the internet, that event-timestamps should only be trusted for the purpose of putting events from a single source in sequence. Comparing them against timestamps from other sources (including your own internal clock) is going to sometimes result in unexpected behavior.

   And, IMO, predictable behavior is better than technical correctness.
5. On Thu, Jan 10 at 4pm,
   Jens Alfke said —

   Yes, clock synchronization is another known issue with certificate revocation. Fortunately the granularity needed is usually pretty low, like hours or days.

   You guys are taking this more seriously than I meant! I was mostly just amused at coming across a real-world example of the “all Cretans are liars” paradox.
6. Name:
   Email:
   Website:
   Name and email are required. Thanks!
   
   [Or log in]    [Or register]

   Or use your OpenID:
   LiveJournal username DeadJournal username Other OpenID URL

   HTML: You may use these tags: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <code> <em> <i> <strike> <strong>

   Notify me of followup comments via e-mail

Design: Hemingway, modified by Chris Gerlach, further modified by me, Jens.

Entries feed   Comments feed