Re: [saag] Or grow a real PKI (Re: SHA-1 to SHA-n transition)

[Nicolas Williams <[e-mail]>]

On Mon, Mar 02, 2009 at 07:44:00PM -0500, Stephen Kent wrote:
> At 2:56 PM -0600 3/2/09, Nicolas Williams wrote:
> >Perhaps the simplest fix, technologically speaking, would be to get a
> >real PKI -- no technical changes needed, just political ones.  But that
> >strikes me as politically infeasible.
> >
> >A real PKI would imply:
> >
> > - trust anchor regulations
> > - CA and DNS registrar regulations that work
> 
> As I noted in the message I sent (which crossed in the ether) this is 
> not uncommon in Asia.  For example, CAs have to be licensed by the 
> government in India (and, I think, South Korea).
> 
> But in the EU and U.S.,  we have a laisse fare approach to CA 
> regulation. That is a political issue.

Indeed.  As I said, I suspect it's a difficult political issue, but
then, perhaps it's not.  I'm not sure how to gauge the likelihood of
success of CA, registrart and browser trust anchor regulation, both as a
political proposal, and if implemented (once implemented we'll know
though :)