Subject: Re: [TLS] Certificate Authorities are not required anymore

From: Peter Gutmann <[email-masked]>
Date: Wed, 13 Feb 2013 12:36:17 +0000

"OMAR HASSAN (RIT Student)" <[email-masked]> writes:

>it is based on the assumption that in most cases there is a registered
>profile for the user on the server; a profile that includes among a lot of
>things the username and the password that the user uses to authenticate to
>the server, the proposed protocol will make use of the username and the
>password to create a key pair for the user on the fly at the client side
>(inside the browser), and it will use this key pair as the starting point for
>creating the secured tunnel instead of taking the server certificate as the
>starting point. Additionally the proposed protocol has self-protection
>against phishing attacks.

How does this improve on TLS-SRP and TLS-PSK, which already do the same thing?

Peter.