Re: [saag] post-X509 cryptographic identities

[Michael Richardson <[e-mail]>]

Nico Williams <[e-mail]> wrote:
    > On Sat, Feb 15, 2020 at 01:57:33PM +0100, Michael Richardson wrote:
    >> Nico Williams <[e-mail]> wrote: > Sure, but PKIX let's
    >> you have this too: it's just an alternate issuer > (root).
    >> 
    >> > What would SPKI have given us, really?
    >> 
    >> No, PKIX does not have an alternate issuer.  That's outside of the
    >> PKIX.  It's another instance of PKIX.

    > Sounds like a matter definitions.

It's not.  It's critically important.
PKIX has no way to name another trust anchor/namespace from within your
current trust anchor/namespace.

X509 was architected on the "There shall be only one" principal, and
all the patching we've had to do (from path name constraints to CT) is to
deal the fact that this is not how things worked out.
[In a strict hierarchal, top-down, PKI, I think a subservient CA would only
ever be able to extend the DN, never change it. That is, constrained would
have been implied]

    >> What SPKI gives is the alternate roots are explainable and codifiable
    >> within the system, rather than making it an externality.

    > Out of curiosity, why couldn't that have been done with PKIX?

Of course, you can write any ASN.1 you want, and you can encode SPKI concepts
in ASN.1, but it wasn't done.

    >> > (A relying party might need to change root trust anchors when
    >> traveling > if they are forced to or want to change roots.)
    >> 
    >> Yes, possibly.  It's definitely an open question, and there is a
    >> tussle there.

    > Sure.  At worst the traveler's origin country and destination might
    > have conflicting requirements and even great firewalls.

So, just like with Netflix: do I get the access of the geo-location of my
credit card, or the geolocation of my device?  Today, in Berlin, I can watch
Big Bang Theory and Dr.Who on netflix (both licensed in Canada to Bell),
while I can't watch Elementary [on Prime].

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works        | network architect  [ 
]     [e-mail]  http://www.sandelman.ca/        |   ruby on rails    [