A paper that notices WebPKI auth is really about certificate context too, then builds a two-plane post-quantum scheme around it.
4 comments
The title sounds like it is fixing WebPKI in general, but the abstract mostly turns into a context bookkeeping scheme with some byte counts, and the actual result is buried under a lot of new vocabulary.
I wouldn’t call that just bookkeeping, the context binding is the actual security claim, and it’s the same old WebPKI chain model underneath, not some new PKI. If anything it looks closer to the certificate_verify separation in TLS 1.3 than a general fix for WebPKI, which is probably why the byte counts matter so much.
If the update plane is the real security claim, does that mean a relying party has to keep a live dependency tree for each view, or can most of that collapse into something more like a cached proof once the profile is fixed?
My read is it has to keep enough of the dependency tree around to know which profile and source contracts it accepted, so a pure cached proof only works if those inputs never change, which seems like a pretty narrow case.