Re: [keyassure] publishing the public key

[Paul Hoffman <[e-mail]>]

On 2/20/11 2:51 PM, Paul Wouters wrote:
> The whole point is we do not want to identify a cert. We want to
> identify a key.

That's not the case currently, at least for many of us. Given that the 
only thing that can be used in TLS to identify the server is a 
certificate, most of us want to identify that certificate (or a trust 
anchor that the certificate chains to).

As one of the document editors, if the WG says that it also wants to 
have keys as targets, I will also need (a) a rationale for why this is 
wanted and (b) text explaining how to make a certificate association 
between the key and the certificate that comes from the TLS server. I 
have asked a few times for these, with no luck so far. I don't know that 
the WG can actually decide to add bare keys without knowing how they 
will be used.