Re: [DNSOP] Practical issues deploying DNSSEC into the home.

[Masataka Ohta <[e-mail]>]

Martin Rex wrote:

> There is no problem with the assumption that trusted third party
> _could_ exist.

It couldn't.

What organization in US can be trusted against attacks by USG?

Note that Snowden demonstrated that even USG failed to keep its
top secret.

> The reason where PKI breaks badly is whenever the third party that
> Bob selected as _his_ third party is not a third party that Alice
> has volutarily chosen herself to trust.  Instead, PKI forces
> Alice to trust dozens of third parties, one or more per every
> Bob out there.

In short, PKI is against the end to end principle, because
CAs are intelligent intermediate systems.

But, if CAs were trusted third parties, it means both Alice
and Bob can safely trust them.

						Masataka Ohta