[saag] post-X509 cryptographic identities

[Michael Richardson <[e-mail]>]

Stephen Farrell <[e-mail]> wrote in a IETF-last call thread:
    > Anyway overall I take this as more evidence that
    > x.509-based pki has outlived it's useful lifetime.
    > Given the webpki needs CT (which it totally does)
    > and now maybe novel revocation mechanisms like this,
    > (as well as soon-to-be PQ schemes if we believe
    > what people tell us), I'd argue it may well be time
    > to try see if there's any consensus on a post-x.509
    > direction towards which to head.

I agree with you strongly.
A centralized, single CRL from the single global PKI was certainly among the
original ideas envisioned.
Then we decentralized the PKI, add CT and added OCSP.

Now we are unifying again :-)
Mozilla could, for instance, create a new higher-level CA, sign all of the
existing trust anchors they ship, and effectively be back at X509.

----

While I am generally not in favour of extensive requirements processes, I
think that this does merit it.   Including publishing the document as
RF*Comments*, and seeking comments widely from other parties.

I am sure that mathmesh fits in here.

I think that the document needs to semi-biographical (or whatever the word is
for a history of thing).
{a creative author could write this in the first person: memoirs of X509}

I think that the document would say a series of things:
  The designers of X500/X509 intended X, but it turned out that this
  did not happen, and instead PKIX did Y.

(One could substitute X=DN, Y=SAN for instance)

I think that it is important for any new identity system to recognize what
forces pushed us away from the original vision.
We made engineering tradeoffs based upon time, code, bandwidth, round-trips
and threats.   Not every such decision is still justified.

So this requirements document would essentially be some kind of loving
criticism.

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-