Re: OpenSSH certified keys

[Damien Miller <djm%mindrot.org@localhost>]

On Tue, 16 Mar 2010, denis bider \(Bitvise\) wrote:

> I second Nicolas's concern. Your spec doesn't even mention revocation. 
> How is revocation handled? Are the keys expected to be certified only 
> for a very short term?
> 
> If certification is expected to be for only a very short term, are you 
> putting an infrastructure in place that allows a client to obtain a 
> fresh certificate before it connects?
> 
> If you are putting such infrastructure in place, do you have a spec for 
> how the client obtains the fresh certificate?
> 
> Otherwise, if you are planning for these certificates to be long-term, 
> what is your solution for revocation?

For OpenSSH, revocation is implemented as a simple list of banned keys.
Since keys are the entity that is revoked and not certificates, and 
because there are no wire-side changes require for revocation, I don't
really see it as part of this certificate specification.

-d