Re: [saag] SHA-1 to SHA-n transition

We have a PKI. We have had a PKI for fifteen years. Its just a PKI that requires people to pay for service. 

If the only PKI that counts is a completely free at point of delivery PKI then I guess that we don't have a DNS system either since the NSF decided to start charging.

What you mean is that a completely free to use PKI would be nice.

We actually have one of those, SSH works quite nicely for what it does. Just not for assuring potential customers that a credit card transaction is safe for them.

Problem is that there are some tasks that really don't work as community efforts. Auditing and preparing taxes for example. If folk work out how to make those work on an open source type model we could maybe try a CA.

What we need to do here is to fix the PKI that we have already deployed and is serving a million Web merchants. Or rather, take out an insurance policy in case we need to fix it at short notice.

-----Original Message-----
From: saag-bounces@ietf.org on behalf of Nicolas Williams
Sent: Thu 2/26/2009 10:55 PM
To: Eric Rescorla
Cc: der Mouse; saag@ietf.org
Subject: Re: [saag] SHA-1 to SHA-n transition

On Thu, Feb 26, 2009 at 06:23:59PM -0800, Eric Rescorla wrote:
> I think you're rather overselling here: this only works well for
> account-based systems. There are plenty of cases where I need to
> connect to someone where I only know their name but I don't yet have
> an account (e.g., https://www.amazon.com). The mechanism that you
> provide doesn't work at all in this case. Rather, you need some
> third-party verifiable mechanism. I suppose one could argue that certs
> aren't a good such mechanism, but they're the one that TLS supports
> and I suspect any replacement would smell a lot like certs.

This is quite true.  I did not address enrolment, nor cases where there
is simply no relationship to be had.  A PKI would sure be nice; I just
don't believe we'll have something very close to one.

Regardless of what we do we're likely to just muddle through in the end.
_______________________________________________
saag mailing list
saag@ietf.org
https://www.ietf.org/mailman/listinfo/saag