Re: [saag] post-X509 cryptographic identities

[Michael Richardson <[e-mail]>]

Tony Rutkowski <[e-mail]> wrote:
    >> Now we are unifying again :-)
    >> Mozilla could, for instance, create a new higher-level CA, sign all of the
    >> existing trust anchors they ship, and effectively be back at X509.

    > And who is going to assume the antitrust liabilities?  See, e.g.,
    > https://www.vox.com/recode/2020/2/6/21125026/big-tech-congress-antitrust-investigation-amazon-apple-google-facebook

Well, that's a reason why re-creating There Shall be Only One PKI is a bad
idea.  RFC2692/RFC2693 already gave us a lot of alternative views.

Typical PKI implementations just makes it really hard for end users to
actually manage their trust anchors, because it pretends that the local trust
anchors were a pronouncement from god.

https://www.rfc-editor.org/rfc/rfc2693.html#section-2.4

2.4 Rethinking Global Names

   The assumption that the job of a certificate was to bind a name to a
   key made sense when it was first published.  In the 1970's, people
   operated in relatively small communities.  Relationships formed face
   to face.  Once you knew who someone was, you often knew enough to
   decide how to behave with that person.  As a result, people have
   reduced this requirement to the simply stated: "know who you're
   dealing with".

   Names, in turn, are what we humans use as identifiers of persons.  We
   learn this practice as infants.  In the family environment names work
   as identifiers, even today.  What we learn as infants is especially
   difficult to re-learn later in life.  Therefore, it is natural for
   people to translate the need to know who the keyholder is into a need
   to know the keyholder's name.

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-