Re: AW: self-signed TSA [Was Re: Private Key Cloning]

[Rich Salz <rsalz@xxxxxxxxxxxxxxxx>]

Aram:
> You shouldn't have to, although this is the model that most public CAs seem
> to push and/or encourage. As I mentioned, a possible solution is the the use
> of "anchor certificates".

Seems a little complicated.

I don't see why I have to introduce an extra entity involved, or extra certs
involved.

Stephen Kent:
> I've always asserted that self-signed certs are just a syntactic
> convenience, not a generally useful way of ensuring security for
> transmitted public keys.  If we agree on that point, then I don't see
> a lot of reason to push for self-signed TSA certs.

I don't agree.  As the service provider, why do I *have* to deal with
the management of two private keys.  It's way more than syntax.

We don't need to "push" anything.  We need to not prohibit it.
	/r$