Re: [saag] post-X509 cryptographic identities

[Nico Williams <[e-mail]>]

On Tue, Feb 11, 2020 at 11:55:16AM +0100, Michael Richardson wrote:
> Stephen Farrell <[e-mail]> wrote in a IETF-last call thread:
>     > Anyway overall I take this as more evidence that
>     > x.509-based pki has outlived it's useful lifetime.
>     > Given the webpki needs CT (which it totally does)
>     > and now maybe novel revocation mechanisms like this,
>     > (as well as soon-to-be PQ schemes if we believe
>     > what people tell us), I'd argue it may well be time
>     > to try see if there's any consensus on a post-x.509
>     > direction towards which to head.
> 
> I agree with you strongly.
> A centralized, single CRL from the single global PKI was certainly among the
> original ideas envisioned.
> Then we decentralized the PKI, add CT and added OCSP.
> 
> Now we are unifying again :-)
> Mozilla could, for instance, create a new higher-level CA, sign all of the
> existing trust anchors they ship, and effectively be back at X509.

The worst thing about x.509/PKIX was x.500 naming, and that's
essentially fixed by using appropriate SANs.  Sure, it's still awful
ugly on the inside, but the naming on the outside is now OK.

That leaves only one lasting bad thing about x.509/PKIX: revocation, and
the answers to that we already know and have and would implement for
PKIX as much as for any PK-based replacement.  Short-lived credentials,
CT, a real root (see below) -- these are things we know to do.

I wouldn't throw the baby out with the bathwater.

However, if we must, then naming is the first thing to get right.
Naming is where the crypto rubber meets the UI/UX road.

And can I refrain from mentioning that DNSSEC is the _only_ true rooted
PKI we've ever managed to deploy?  Evidently I can't.

Nico
--