Re: DER encoding in RFC 3161

Manger, James <[email protected]> writes:

>Such whole-of-cert fingerprints are very widely used, but a slight change of
>context (from an allowlist to a blocklist) can make them unexpectedly
>dangerous.

Sure, but if you're using default-allow (= blocklist), which makes #1 in the
"The Six Dumbest Ideas in Computer Security",
https://www.ranum.com/security/computer_security/editorials/dumb/, then your
security mechanism is broken from the start and you need to fix the mechanism
you're using.

(This was debated years ago on this very list: We can't use cert fingerprints
because they're not bug-compatible with the default-allow brokenness of CRLs
et al, which is one reason why after thirty-odd years we're still permanently
stuck behind attackers who can move faster than our blocklists can catch up).

Peter.