《u magazine》
Link: Peter Gutmann on PKI
Everything you never wanted to know about PKI but were forced to findout [PDF]by Peter Gutmann is a set of slides about just that: a pile of the wartsand issues with PKI in general and the SSL model in specific.If you're interested in the whole field, his home page has links to enough additionalpapers to keep you reading for some time.
(From Chris Samuel ,and that in turn from Russell Coker .)
英皇駿景102
我早說過,我愛過的人,一生都會掛心。
甚至,分開後還是會回頭照顧他。
可是,經過昨夜,再笨也總得明白,他需要的只是酒精。
就算他已破了產事業不順心夜夜酒醉,我也從不在意。
唯一的心願就是
復活金狼
Why I want direct certificate checking instead of having to rely on CAs
The common SSL model is that you verify someone's good nature bychecking to see that their certificate is signed by an approved CA.For example, if you are verifying that hosts you are connecting toare approved you would make up a CA certificate, then make up a bunchof host certificates and sign them with the CA certificate. When youconnect to a machine, you verify that its certificate is signed by yourCA certificate.
(Except that that's a simplification; you actually need to verify that
對我們微笑
有朋友靜靜地離開了
我們之間沒有很多的溝通
不過
每次見到他
他的笑容總是令我深刻
上路
愉快
我想起這首歌
同樣是有人離開了而寫的
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
對我們微笑 (raido blog
合理得近於卑微
得閒飲湯
A grump about the socket module's SSL support
It is nice that Python's socket module has simple SSL support (although it has some limitations ). My grump is that it doesn't giveyou any good way of checking the identity of the server'scertificate, which is especially annoying as the SSL codedoesn't do any certificate verification.
(This matters to me because I have recently become quiteinterested in being able to verify machines by checkingthat they have a specific SSL certificate.)
What SSL objects have is .issuer( ) and