RE: NEW Data type for certificate selection ?

[Sievänen Markku <markku.sievanen@xxxxxxxx>]

Hi!

Tony, don't mix the diffrent roles of PKI. CA is not responsible, if
your's "Acme Hardware" doesn't
return to You anything. CA is only responsible that there is a "secure
path" to validate the check, which is digitally signed. And in that role
CA and PKI infra works fine, if it is build up correctly with building
blocks like smart cards, certicate policies and so on.

Of course, in addition to that, You need "specific security protocols"
to different application sectors, like
e-commerce, to make the whole system work. These protocols might use
Notary Services to make sure,
that "You really get what you paid".

MaSi

> -----Original Message-----
> From:	Tony Bartoletti [SMTP:azb@llnl.gov]
> Sent:	Friday, October 02, 1998 9:00 PM
> To:	Anders Rundgren; 'Ed Gerck'
> Cc:	'ietf-pkixÉimc.org '
> Subject:	RE: NEW Data type for certificate selection ?
> 
> At 07:59 AM 10/2/98 +0200, Anders Rundgren wrote:
> >Ed,
> >>The first usual misconception here is when people confuse trust in a
> >>certificate to trust in a certificate's contents -- too quite
> >>different animals. In fact, the first is directly defined under
> X.509
> >>or PKIX but the second depends on the CPS, which depends on each CA,
> >>which systematically negate it.
> >
> >Systematically negate it?
> >
> >Sorry, I fail to understand why it is technically, legally, etc.
> impossible to create trusted
> >CA services that issues certificates with contents that can actually
> be used.  But as I said earlier,
> >Swedes are probably morons as we just do it anyway in spite of the
> fact that it does not work :-)
> >
> >Anders
> 
> Anders,
> 
> Current certification systems do "work", much as an ordinary telephone
> directory works.  The analogy would be closer if the publisher of the
> phone book digitally signed each entry.
> 
> The phone book works because most people are honest and want to help
> make things work.  But I have no real way of knowing that the entry
> for "Acme Hardware, Third Street" is indeed a hardware store, or can
> be trusted to perform as I might expect it to.
> 
> People expect a digital-sig PKI to somehow automatically provide the
> root of trust that is needed.  Indeed, the terminology "root key",
> "root CA" suggests as much.  But unless a third party can be relied
> upon to reimburse me for my losses, when I send a digital check to
> "Acme Hardware" and recieve nothing in return, this third party is
> really not much more than a telephone directory.
> 
> We want more, and need more from PK technology.  The emerging PKIs
> are a start, a component, and a limited one.  Again, it does "work"
> in a statistical sense, because most people are not crooks.
> 
> My 2 cents.
> 
> ___tony___ 
> 
> 
> 
> Tony Bartoletti                                             LL
> SPI-NET GURU                                             LL LL
> Computer Security Technology Center                   LL LL LL
> Lawrence Livermore National Lab                       LL LL LL
> PO Box 808, L - 303                                   LL LL LLLLLLLL
> Livermore, CA 94551-9900                              LL LLLLLLLL
> email: azb@llnl.gov   phone: 510-422-3881             LLLLLLLL