RE: NEW Data type for certificate selection ?

[Tony Bartoletti <azb@xxxxxxxx>]

At 07:59 AM 10/2/98 +0200, Anders Rundgren wrote:
>Ed,
>>The first usual misconception here is when people confuse trust in a
>>certificate to trust in a certificate's contents -- too quite
>>different animals. In fact, the first is directly defined under X.509
>>or PKIX but the second depends on the CPS, which depends on each CA,
>>which systematically negate it.
>
>Systematically negate it?
>
>Sorry, I fail to understand why it is technically, legally, etc. impossible to create trusted
>CA services that issues certificates with contents that can actually be used.  But as I said earlier,
>Swedes are probably morons as we just do it anyway in spite of the fact that it does not work :-)
>
>Anders

Anders,

Current certification systems do "work", much as an ordinary telephone
directory works.  The analogy would be closer if the publisher of the
phone book digitally signed each entry.

The phone book works because most people are honest and want to help
make things work.  But I have no real way of knowing that the entry
for "Acme Hardware, Third Street" is indeed a hardware store, or can
be trusted to perform as I might expect it to.

People expect a digital-sig PKI to somehow automatically provide the
root of trust that is needed.  Indeed, the terminology "root key",
"root CA" suggests as much.  But unless a third party can be relied
upon to reimburse me for my losses, when I send a digital check to
"Acme Hardware" and recieve nothing in return, this third party is
really not much more than a telephone directory.

We want more, and need more from PK technology.  The emerging PKIs
are a start, a component, and a limited one.  Again, it does "work"
in a statistical sense, because most people are not crooks.

My 2 cents.

___tony___ 



Tony Bartoletti                                             LL
SPI-NET GURU                                             LL LL
Computer Security Technology Center                   LL LL LL
Lawrence Livermore National Lab                       LL LL LL
PO Box 808, L - 303                                   LL LL LLLLLLLL
Livermore, CA 94551-9900                              LL LLLLLLLL
email: azb@llnl.gov   phone: 510-422-3881             LLLLLLLL