Re: [pkng] some thoughts

[Leif Johansson <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Peter Saint-Andre wrote:
> On 11/12/09 1:27 PM, Leif Johansson wrote:
> 
>> 1. bottoms up vs top down
>>
>> In PKIX the key relationship is between the key and the CA. I
>> believe PKNG should turn this around and be designed based on the
>> relationship between the key and the key consumer.
>>
>> I'm consciously trying to avoid using terms like user-centric or
>> user-managed since they evoke images of specific technologies or
>> patterns and in fact I'm thinking about the RPKI and the KARP
>> when writing this.
> 
> Leif, I skimmed your email while I was sitting in the DTNRG session this
> morning, so the mention of bottom up rang a bell. PKI is impossible when
> there is no "I" to be had (distressed networks, ad-hoc meshes, etc.). As
> people carry more and smaller personal devices, they might want to
> exchange information directly in their interactions (beamed, radioed,
> etc.). They won't necessarily have access to canonical sources of trust
> located in hierarchies or roots. Further, they might not *care* about
> hierarchical trust, instead putting a higher value on bottom up or peer
> to peer trust. Perhaps trust will be based more on social networking and
> personal interconnections (think IM buddy lists, LinkedIn, Facebook,
> Twitter). Keys and certs (or whatever we end up calling them) are cheap,
> so people might generate new ones when needed (or for different
> purposes), check credentials with people or entities in their network
> only when they interact with a person, etc. We have ways to push this
> information out (hey everyone, I've got a new keything) and for
> performing on-demand checks (hey Leif, Paul says his keything has a
> print of foo, is that consistent with what you know?).
> 
> Just a few random ideas generated on the Nozomi train out of Hiroshima... :)
> 
> Peter
> 
> --
> Peter Saint-Andre
> https://stpeter.im/
> 

Yeah this is how I think about it too - to buzz a word: crowdsourcing
identity (but we'll have to be careful not to build another pgp that
doesn't have a business model).

	Cheers Leif
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkr/J6gACgkQ8Jx8FtbMZnfKRQCgpf+3Ygw2DTRhym94mLqecE7q
guQAn2/ZkkDNgB4m+BtKMPj3WI53r3tq
=QUSC
-----END PGP SIGNATURE-----