Re: [certid] draft slides for IETF 77

[Paul Hoffman <[e-mail]>]

At 10:47 PM -0600 3/18/10, Peter Saint-Andre wrote:
>On 3/18/10 3:20 PM, Shumon Huque wrote:
>> On Thu, Mar 18, 2010 at 02:05:15PM -0700, Paul Hoffman wrote:
>>> At 1:28 PM -0600 3/18/10, Peter Saint-Andre wrote:
>>>> Content-Type: multipart/signed;
>>>> protocol="application/pkcs7-signature"; micalg=sha1;
>>>> boundary="------------ms080304070605060202080805"
>>>>
>>>> I've been asked to make a presentation about our work to the PKIX
>>>> WG session on Monday at 15:20 Pacific. Draft slides are attached
>>>> and feedback is welcome -- this is mostly just an overview to get
>>>> people interested in reviewing the I-D and providing feedback.
>>>
>>> In slide 3: s/PKI/PKIX. OpenPGP has its own (unspecified) PKI.
>>>
>>> But, more importantly in slide 3: Bullets 2, 3, and 5 disagree with
>>> each other. A server is a machine; it is not a domain or a URI. A
>>> domain name is not a URI. And so on. Consider adding a bullet
>>> saying "this is known to be unclear".
>>>
>>
>> I think "server" here refers not to a machine or set of machines, but
>> to an "application service" (application server?), ie. the server
>> side component of a client-server protocol.
>
>Correct.

A public key listed in a certificate is associated with *something* that has access to the associated private key. The machine has access to that private key, as does the server application/daemon. If you want to make this distinction, you need to do so much more clearly in the draft.