Competing Authorities

Relationship between receiving authorities and monitoring authorities. The EMEA experience.

The approach of the European Medicines Agency (EMEA) to good laboratory practice (GLP) inspections in the context of authorization of medicinal products is illustrated with particular reference to the EMEA's experience as a receiving authority (RA), the procedures it has in place for the reporting and follow-up of GLP inspections, and the role of the ad hoc GLP inspectors working group. Other k...

Decentralized Certificate Authorities

The security of TLS depends on trust in certificate authorities, and that trust stems from their ability to protect and control the use of a private signing key. The signing key is the key asset of a certificate authority (CA), and its value is based on trust in the corresponding public key which is primarily distributed by browser vendors. Compromise of a CA private key represents a single poi...

The Local Authorities' Part

Bamboozling Certificate Authorities with BGP

The Public Key Infrastructure (PKI) protects users from malicious man-in-the-middle attacks by having trusted Certificate Authorities (CAs) vouch for the identity of servers on the internet through digitally signed certificates. Ironically, the mechanism CAs use to issue certificates is itself vulnerable to man-in-the-middle attacks by network-level adversaries. Autonomous Systems (ASes) can ex...

Revocation Schemes for Delegated Authorities

We have previously presented a framework for updating privileges and creating management structures by means of authority certificates. These are used both to create access-level permissions and to delegate authority to other agents. In this paper we extend the framework to support a richer set of revocation schemes. As in the original, we present an associated calculus of privileges, encoded a...