From owner-freebsd-questions@FreeBSD.ORG Wed Jun 6 19:27:04 2012 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 8995A106566C for ; Wed, 6 Jun 2012 19:27:04 +0000 (UTC) (envelope-from bonomi@mail.r-bonomi.com) Received: from mail.r-bonomi.com (mx-out.r-bonomi.com [204.87.227.120]) by mx1.freebsd.org (Postfix) with ESMTP id 3E1668FC20 for ; Wed, 6 Jun 2012 19:27:03 +0000 (UTC) Received: (from bonomi@localhost) by mail.r-bonomi.com (8.14.4/rdb1) id q56JRPLp033735 for freebsd-questions@freebsd.org; Wed, 6 Jun 2012 14:27:25 -0500 (CDT) Date: Wed, 6 Jun 2012 14:27:25 -0500 (CDT) From: Robert Bonomi Message-Id: <201206061927.q56JRPLp033735@mail.r-bonomi.com> To: freebsd-questions@freebsd.org In-Reply-To: <4FCFA529.1020703@my.gd> Subject: Re: Is this something we (as consumers of FreeBSD) need to be aware of? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Jun 2012 19:27:04 -0000 > From owner-freebsd-questions@freebsd.org Wed Jun 6 13:46:43 2012 > Date: Wed, 06 Jun 2012 20:44:57 +0200 > From: Damien Fleuriot > To: freebsd-questions@freebsd.org > Subject: Re: Is this something we (as consumers of FreeBSD) need to be aware > of? > > > > On 6/6/12 7:23 PM, Robert Bonomi wrote: > > "Julian H. Stacey" wrote: > >> > >>> I do wonder about that. What incentive does the possesor of a signing key > >>> have to keep it secret? > >> > >> Contract penalty clause maybe ? Lawyers ? > > > > Contract with _whom_? The party you pay money to -- Verisign -- simply > > certifies that the party buying the certificate/signing-key -is- who they > > claim to be. > > > > It is *entirely* up to the owner of that certificate/signing-key -who- they > > allow to use it. > > > > If someone/anyone attempts to 'revoke' that certificate/key _other_ than > > at the request of the owner of that certificate/key, *THAT* party is subject > > to legal sanctions. Among other things, 'false persona', 'tortuous inter- > > ference in a business relationship', just to name a few. > > > > There is, however, an 'interesting' legal question -- *if* a party were to > > let 'anybody' use their certificate/key, what is the certificat/key owner's > > legal liability if someone uses that key to sign malware? > > Standard contract writeup stipulates that only a limited set of > 'authorized' company representatives be given access to the Signing Key. Which simply begs the question. _who_ decides who is or is not an 'authorized' representative? Or how many such persons are allowed? > If the key should be divulged, then the key may be revoked by the issuer. Suppose I put up a web app that takes an executable as input, signs it with my key, and returns the signed filt to the submitter. I don't divulge the key to anyone, just use it on 'anything'. Anybody attempting to revoke on _that_ basis is asking for a lawsuit.