RE: KISS for PKIX. (Was: RE:Asymmetric authentication

[Stephen Kent <kent@xxxxxxx>]

Steve,

>I think we should make things as hard as possible to access the private
>authentication information, but this approach doesn't (unless I
>misunderstand) offer a way to engage the central site.  It may take me
>longer, but I can still crack the sole authentication method 'off-line'.

Yes, if the public key is publically available, as would usualy be the case
for a cert-based system, this approach only increases the work factor
lineraly, as David pointed out.

Steve