Re: [Asrg] Consent Proposal

[Markus Stumpf <[e-mail]>]

On Tue, Jul 01, 2003 at 08:12:17PM -0400, Yakov Shafranovich wrote:
> What about a central CA issuing certificates to other CAs, controlled by 
> IANA or ICANN-type of organization?

You mean to set the cat among the pigeons ;-)
What you would need is a mechanism that creates and equal level of trust.
As soon as I get a cert from CA-1 for 5 bucks and all that is needed is
a working email address and CA-2 requires payment of 100 bucks and you
have to send in legal papers and stuff you will create different levels
of trust. That's what we have now. We have DNSBLs: some use them some
not (no trust). Some block dialin IPs some not (diffferent levels of
trust). What if in a country some of the legal documents required by
CA-2 simply don't exist? In the US (I believe) there is something
called social insurance number (or the like). Maybe in Dubai (I don't
know) such a thing does not exist and nothing similar. But this would be
required by a CA to identify e.g. a person. Would it mean people from Dubai
can't get signed keys?

And there is a social/commercial problem:
What if in our country the two biggest emails providers with a share of
say 30% don't stick to that system? What would I tell my customers?
While private customers might understand it corporate customers will
not understand why they can't talk to business partners any longer.

And: you can't add pressure, as some of the smaller ISPs will say: "as
our customer you can still receive mail from them. Leave your current
ISP and join us". Big deal :(

> There are mechanisms in place to check 
> verifications of certificates in real-time, and that can be implemented as 
> well.

Hmmm ... take e.g. Verisign. I'd guess they have issued the most certs.
What do you think would be needed as infrastructure so that every
browser accessing a SSL site can verify the cert (e.g. if revoked) in
real-time?
certs work, because the producer of the browser added the CA keys
of CAs to the browser and users depend on the producers of the browser
and these depend on the CA to "do the right thing". If a key is signed
by a "trusted" CA it's also trusted "per definitionem". We don't have
working revocation mechanisms.

To make it clear:
I'd be more than glad if those methods would exist. There are patches
for nearly all Mailservers to support SSL connections (STARTTLS) but I'd
guess the percentage of mailservers using it has a lot of 0s after the
decimal point and in front of the 1.

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: [phone]
Research & Development |       D-80807 Muenchen    | Fax: [phone]
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"

_______________________________________________
Asrg mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/asrg