On Fri, Oct 07, 2022 at 06:19:15PM +0000, Blumenthal, Uri - 0553 - MITLL wrote:
> Then publish the certificate. Then the victim is unable to read email
> encrypted to her. A DoS that costs the attacker very little,
> practically nothing.
What victim is that?
All the PoP does is make it harder to convince your CA to attest that
someone else's key is yours. It plays no role in the most critical role
of your CA, which is to not attest that your key is someone else's.
The scenario you suggest seems to me to require the latter.
--
Viktor.
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
