Re: [pkng] Where to go? What to do?

[Massimiliano Pala <[e-mail]>]

Hi Paul, all,

as I wrote in my previous post, the lack of spare time (and funds) prevented me to
start working on the PKI-NG, although I do really think it could potentially impact
(finally) the whole Internet by providing a more usable trust infrastructure deployment
system/support/etc.

I recently (well.. this year!) published the ideas about how to solve some of the
most important issues we face today (let me know if you need a copy):

   http://portal.acm.org/citation.cfm?id=1750389.1750404

[sorry for the self-reference, but I think this could provide the group with
  an initial working item]

The basic idea is to provide the Internet with a support system for:
- PKI deployment
- Interaction between clients and PKIs
- Ease service discovery
- Allow for Trust Anchor simplified management by allowing users to
   trust Federations of CAs instead of having to trust each CA separately

My idea would be to provide two documents. The first describing the overall
infrastructure and the PKS distributed protocol. This is the protocol that
would allow PKI-to-PKI interactions via a distributed P2P overlay network.

By implementing it, PKIs could be enhanced by:
- making it easy for applications to discover and use existing PKI services
- making it easy to add new services or remove existing ones by routing
   messages on the distributed network
- potentially reducing the size of the certificates since not much info is
   needed in the certificate anymore besides the identifier of the issuing CA
- allowing PKI-to-PKI services (e.g., request about the status of key material -
   is this p-key compromised ? To avoid weak or compromised keys to be used
   across different PKIs)

The second describing the client-server protocol for Public Key Operations. Like
the DNS, I envision the presence of local PKS nodes that would act as gatways
for applications for interacting with the PKI network. This protocol could use
HTTP to be compatible with today's clients, or use a more efficient binary one
to boost performances and lower implementation errors/bugs.

What I published is a possible starting point for a discussion on the matter
if people here in the list are interested in providing a PKNG support system that
allows for PK services to be deployed easily and new services/trust models to
be built and deployed on top of it.


Later,
Max


On 09/28/2010 04:22 PM, Paul Hoffman wrote:
> Greetings again. This list has not been used to good measure yet, and it is not clear
> if it will be. This would be a good time to find out.