Re: [keyassure] publishing the public key

[Stephen Kent <[e-mail]>]

At 4:29 PM +0100 2/21/11, Henry Story wrote:
>(Just a summary of what I understood of this thread, and a few new ideas)
>
>On 20 Feb 2011, at 23:58, Paul Hoffman wrote:
>
>>  On 2/20/11 2:51 PM, Paul Wouters wrote:
>>>  The whole point is we do not want to identify a cert. We want to 
>>>identify a key.
>>
>>  That's not the case currently, at least for many of us. Given that 
>>the only thing that can be used in TLS to identify the server is a 
>>certificate, most of us want to identify that certificate (or a 
>>trust anchor that the certificate chains to).
>
>One needs to go beyond appearances a little here. My argument is 
>that what identifies a server in TLS is a public key.

Do you mean "identifies" or "authenticates?" I think most folks view 
the DNS name (or URL) as the identity of the web site. We're debating 
the mechanics
of how to enable a client to verify that the asserted identity 
matches the client's expectations, based on the content of a series 
of DNS records.

Steve