PKIs: added references, changed wording

diff --git a/src/PKIs.tex b/src/PKIs.tex
index 805c546..4efe3c9 100644 (file)
--- a/src/PKIs.tex
+++ b/src/PKIs.tex
@@ -2,17 +2,24 @@
 \label{section:PKIs}
 
 Public-Key Infrastructures aim to provide a way to simplify the verification of
-a certificate's trustworthiness.  For this, certificate authorities (CAs) are
-used for creating a signature chain from the CA down to the server (or client).
+a certificates trustworthiness.  For this, certificate authorities (CAs) are
+used to create a signature chain from the root CA down to the server (or client).
 Accepting a CA as a generally-trusted mediator solves the trust-scaling problem
 at the cost of introducing an actor that magically is more trustworthy.
 
-This section deals with settings related to trusting CAs.  However, our main
+This section deals with settings related to trusting CAs. However, our main
 recommendations for PKIs is: if you are able to run your own PKI and disable
-any other CA, do so.  This is mostly possible in any machine 2 machine
-communication system where compatibility with externalities is not an issue.
+any other CA, do so. This makes sense most in environments where any machine-to-machine
+communication system compatibility with external entities is not an issue.
+%% azet:
+%% this needs discussion! self-signed certificates simply do not work in practices
+%% for real-world scenarios - i.e. websites that actually serve a lot of people
 
-A good background on PKIs can be found in \todo{insert reference}.
+A good background on PKIs can be found in 
+\footnote{\url{https://developer.mozilla.org/en/docs/Introduction_to_Public-Key_Cryptography}}
+\footnote{\url{http://cacr.uwaterloo.ca/hac/about/chap8.pdf}}
+\footnote{\url{http://www.verisign.com.au/repository/tutorial/cryptography/intro1.shtml}}
+.
 
 \todo{ts: Background and Configuration (EMET) of Certificate Pinning, TLSA integration, 
   When to use self-signed certificates, how to get certificates from public CA authorities