Re: A proposal for secure videoconferencing and video messaging over the Internet

[amanda]

On Wed, 26 Jul 2000, Eugene Leitl wrote:
> Clearly, you can maintain a secure connection to an anonymous party.
 
No you cannot. If Bob is anonymous then it is impossible for Alice to
know if her secure connection goes to Bob or Mitch. In the classic
man-in-the-middle attack Mitch impersonates Bob when talking to Alice and
he impersonates Alice when talking to Bob.

Did you read the literature on this stuff?

[Depends on what you mean by "anonymous". If the anonymous party has a
key he uses (i.e. the equivalent of a "nym") there is no problem at
all and no need for a CA either... --Perry]

> Authentication and security only touch shoulders when you're
> trusting the public key server

You are not supposed to trust key servers. It is the keys that you trust,
because they are signed by someone you trust (the CA or your WOT).


Amanda.