Re: [saag] post-X509 cryptographic identities

["Derek Atkins" <[e-mail]>]

On Tue, February 11, 2020 9:26 am, Michael Richardson wrote:
>
> Derek Atkins <[e-mail]> wrote:
[snip]
>     > Should this document also include the history of other PKIs, such as
> SPKI
>     > and/or OpenPGP's WoT?  I think it would be interesting to put an
>     > historical contrast on the visions behind the various
> methods/standards
>     > and perhaps try to document the reasons (if possible) that "market
> forces"
>     > took us in one direction vs another.
>
> Yes, I think that it has to.
>
> Each evolved either as a response to X509.  Restating 2692/2693 or the
> design
> requirements for OpenPGP is not called for; distilling what criticism were
> in
> common and why SPKI did not fly is important.  And is there something
> technical wrong with OpenPGP, or are we dealing with implementation
> issues?

My personal opinion is that it was neither a technical issue nor an
implementation issue that caused the market to choose X509 vs OpenPGP, but
rather a philosophical issue (or perhaps business-money-making choices).

On the other hand, if we're going to rehash the design requirements for
X.509, I think it makes sense to also rehash the differences in
requirements for SPKI and OpenPGP (and maybe even DNSSec).  Specifically,
it's important to discuss how they differed, but also in what ways they
overlapped.  I do agree we don't need to go into the full history of all
of them (including X.509).

Again, this is just my opinion from someone who was deep in the trenches
back in the 1990s.

-derek

-- 
       Derek Atkins                 617-623-3745
       [e-mail]             www.ihtfp.com
       Computer and Internet Security Consultant