Re: [pkng] fyi: keyassure@ mailing list - aka tls@dnssec, certs/keys-in-DNS(sec), DKI

[Massimiliano Pala <[e-mail]>]

Hi Stephen, all,

I would say that I am more with Paul on this. I do think that there's a real
need to re-invent the PKIs, especially in the way they are deployed. Indeed,
it is quite difficult to provide interoperability among different infrastructures
also when cross-certification is used.

I have been pushing back my contribution to this list because of the huge load
of work.. unfortunately it does not look better in the near future :) But, as
soon as I find some funds to work on my ideas (always the same problem, isn't
it?) I will try to write an initial document that the list could work on.

The current areas I am planning on working on are:
- trust infrastructure service discovery
- support for PKIX (and non-PKIX) trust infrastructures
- dynamic federation support
- scalability

My plan is to approach these problems by providing an underlying collaborative
infrastructure that will enable the deployment of a globally distributed trust
infrastructure for the Internet.

Work in Progress..

    -- Max


On 08/18/2010 08:00 PM, Stephen Farrell wrote:
>
>
> On 19/08/10 00:36, Paul Hoffman wrote:
>> Not at all. PKNG's charter is to "look into alternate certificate formats, semantics,
>> and PK services that could eventually replace PKIX if deployed".
>
> Right. Zero documents and a moribund list seem to imply the charter was wishful
> thinking.
>
>> The new mailing list is aimed at protocols that use PKIX certificates, and the draft
>> that I co-authored is specifically about TLS, which requires a PKIX certificate to
>> identify the server.
>>
>> This list can still be useful within our charter if folks get get some creative
>> juices flowing around the idea of alternate formats, semantics, and services.
>
> (Don't I recall you saying that new format work was exactly what you didn't want to
> happen first?)
>
> Look, if something does start to happen here, then that'd be great. All I'm saying is
> that given the (lack of) history here and the evident interest in
> websockets/keys-in-DNS et al I suspect the relevant CPU cycles are going to be invested
> elsewhere for the next while. I'd be delighted to be proven wrong.


-- 

Best Regards,

	Massimiliano Pala

--o------------------------------------------------------------------------
Massimiliano Pala [OpenCA Project Manager]                   [e-mail]
                                                  [e-mail]

Dartmouth Computer Science Dept               Home Phone: [phone]
PKI/Trust Laboratory                          Work Phone: [phone]
--o------------------------------------------------------------------------
People who think they know everything are a great annoyance to those of us
who do.
							   -- Isaac Asimov