#TIL China has a national standard, SM9, on Identity-Based Cryptography. IBC is a cool cryptosystem, there's a math connection between your public key and your name (username, domain name, etc), so everyone can use your name as the public key without any authorities or key servers, nevertheless its traditional form has a huge technical limitation - it requires a Key Generation Center to generate your private keys. "All your key are belong to us!"

There's an RFC draft to include it in TLS, and see how the backdoor is justified... Man-in-the-Middle attacks can be detected by forensic analysis, are you kidding me?

To be fair, the CA PKI system has the same backdoor - in both systems the authorities can pretend to be anyone, if you use the key strictly for signing, not encryption, arguably IBC is not worse than PKI.

But at least a CA leaves an auditable record if you enforce Certificate Transparency requirements. Meanwhile IBC KGC can do the same without leaving a trace. #cryptography