Re: [9fans] pop3 before smtp

[David Presotto <presotto@closedmind.org>]

[-- Attachment #1: Type: text/plain, Size: 809 bytes --]

The x.509 PKI is distributed.  The only problem with it is that noone
takes responsibility for anything.  I'ld be happy to believe a CA about
a cert it signs if the cert itself didn't contain a scree about how
the CA absolves itself of all responsibility.

Also, the revocation problem has also never been well handled.  There are
revocation servers out there but they tend to be overloaded and often
unavailable.  Shorter term keys would help accept then one of the big
advantages of having a CA would disappear, i.e., that you wouldn't
have to talk to it very often.  With revocation lists and/or short
lived keys, shared keys don't look so bad anymore.

The result is that the one org willing to take financial responsibility,
i.e. Microsoft, can get away with something as crufty as Passport.

[-- Attachment #2: Type: message/rfc822, Size: 2972 bytes --]

From: Dan Cross <cross@math.psu.edu>
To: 9fans@cse.psu.edu
Subject: Re: [9fans] pop3 before smtp
Date: Thu, 10 Jul 2003 17:50:47 -0400
Message-ID: <200307102150.h6ALol704789@augusta.math.psu.edu>

> | What is needed is a distributed PKI.
>
> But why?  It seems easy enough to use use private keys, and a nice
> protocol like SRP.

Well, the typical reason given is that you end up with this n^2 key
distribution problem.  PKI (in theory, at least) solves that via
signature chains.  Shared secret key systems like Kerberos have
attempted to solve this with authentication hierarchies, but while
e.g.  Kerberos has proliferated, the hierarchial authentication
component hasn't.

I don't understand this talk of `distributed PKI' though; isn't the
whole idea of a PKI that it's distributed to begin with?  Supposedly we
have that; it's just never really worked all that well.

It's a shame.  Public key cryptography involves some absolutely
beautiful mathematics.  Too bad people are disgusted with it due to the
poor implementations they most frequently encounter.

	- Dan C.