Closed wrygiel closed 8 years ago
Could you please provide an example attack scenario which (a) is possible in this architecture, and (b) is not possible in EMREX architecture?
As far as I remember, EMREX registry is being served in a very similar fashion, but it is being updated by sending an email to the registry administrator, while our registry will be updated by changing the manifest file. Is this the only difference?
BTW - https://github.com/erasmus-without-paper/ewp-specs-architecture/issues/2 - we will probably be hosting public keys (instead of certificates). But I guess this doesn't change things much.
There was some further discussion on this in Oslo, but - thus far - no security issues were found with the current approach.
@richared wrote: