Re: [saag] post-X509 cryptographic identities

[Tony Rutkowski <[e-mail]>]

Hi Derek,

The market was a minor factor.  PKI invokes more legal and public policy 
considerations than probably any other electronic communication sector.  
It emerged as a governmental platform for trusted identity management 
and was pursued in intergovernmental bodies with links into treaty 
instruments.

The ILPF very quickly came to focus almost exclusively on PKI in work 
led by Stewart Baker who had just left as NSA's GC. Verisign's early 
hire was Michael Baum who as Vice President of Practices and External 
Affairs, helped enable the marketplace by dealing with legal issues, and 
played a major role in getting PKI accepted worldwide. (Acknowledgement: 
I was also a VeriSign VP and a lawyer.)

PKI is a fundamental part of the EU's regional security strategy, as it 
is in most nations.  PKI implementations also dramatically shape 
marketplace competition - a subject now of rather intense scrutiny on 
both sides of the pond - and culpability extends both to individuals and 
standards bodies.

--tony

On 2020-02-11 9:40 AM, Derek Atkins wrote:
> On Tue, February 11, 2020 9:26 am, Michael Richardson wrote:
>> Derek Atkins <[e-mail]> wrote:
> [snip]
>>      > Should this document also include the history of other PKIs, such as
>> SPKI
>>      > and/or OpenPGP's WoT?  I think it would be interesting to put an
>>      > historical contrast on the visions behind the various
>> methods/standards
>>      > and perhaps try to document the reasons (if possible) that "market
>> forces"
>>      > took us in one direction vs another.
>>
>> Yes, I think that it has to.
>>
>> Each evolved either as a response to X509.  Restating 2692/2693 or the
>> design
>> requirements for OpenPGP is not called for; distilling what criticism were
>> in
>> common and why SPKI did not fly is important.  And is there something
>> technical wrong with OpenPGP, or are we dealing with implementation
>> issues?
> My personal opinion is that it was neither a technical issue nor an
> implementation issue that caused the market to choose X509 vs OpenPGP, but
> rather a philosophical issue (or perhaps business-money-making choices).
>
> On the other hand, if we're going to rehash the design requirements for
> X.509, I think it makes sense to also rehash the differences in
> requirements for SPKI and OpenPGP (and maybe even DNSSec).  Specifically,
> it's important to discuss how they differed, but also in what ways they
> overlapped.  I do agree we don't need to go into the full history of all
> of them (including X.509).
>
> Again, this is just my opinion from someone who was deep in the trenches
> back in the 1990s.
>
> -derek
>