[pkng] Some topics for PKNG

["Thomas Hardjono" <[e-mail]>]

Folks,

I'm new to PKNG RG, but looking at the mail-list contributors it seem like the same usual suspects :)

Here are a couple of topics that perhaps the RG could look at.

(1) Simple certs:

A while back when I was involved in IEEE802.11 TGi and EAP-TLS, there was some discussion (complaints) about the "complexity" of current X.509 certs.  Non-PKI folks there just wanted a "simple X509" cert with a small number of fields. No policy related fields, no alternate names, no access control info, etc. etc.

Perhaps such a "simple cert" would go along way towards allowing my Mom/Grandma to understand it when she sees one :)


(2) Simple standardized "trust contracts":

I know people have been talking forever about a "flat hierarchy" or "bottom-up trust" (BUT) ala PGP and IM. See Leif's slides on PKNG.

In my experience, the flat or bottom-up trust model works for non-value transactions (like IM, FaceBook, etc). As soon as $$$ is involved, the parties will want to know where the buck stops (or who to take to court). 

It seems that in order to boot-up this notion of BUT, we need to also supply some limited stock/ready-made simple "trust contract", where person A will "trust" person B if both sides will digitally sign an agreed "trust contract" that is legally binding. This is one step further than the usual PGP-signing session at the IETF.

PS. When you sign-up to eBay, you are essentially signing-up to some legal contract that limits eBay's liability. Same with buying a cert from VeriSign (see its CPS).

Would this item be in-scope for PKNG?

/thomas/