Re: [saag] post-X509 cryptographic identities

[Nico Williams <[e-mail]>]

On Sat, Feb 15, 2020 at 01:57:33PM +0100, Michael Richardson wrote:
> Nico Williams <[e-mail]> wrote:
>     > Sure, but PKIX let's you have this too: it's just an alternate issuer
>     > (root).
> 
>     > What would SPKI have given us, really?
> 
> No, PKIX does not have an alternate issuer.
> That's outside of the PKIX.  It's another instance of PKIX.

Sounds like a matter definitions.

> What SPKI gives is the alternate roots are explainable and codifiable within
> the system, rather than making it an externality.  

Out of curiosity, why couldn't that have been done with PKIX?

>     > Cross-signing roots ~= a root anyways.
> 
>     > Every country could run its own roots with mostly or entirely the same
>     > contents as all the others.  From a relying party's point of view,
>     > there's a single root, and _that_ is what matters.
> 
> This would almost be the same thing, except for the liability and
> soveignty issue.

Indeed.

>     > (A relying party might need to change root trust anchors when traveling
>     > if they are forced to or want to change roots.)
> 
> Yes, possibly.  It's definitely an open question, and there is a tussle there.

Sure.  At worst the traveler's origin country and destination might have
conflicting requirements and even great firewalls.

>     > Sovereigns always immunize themselves.  You will not be able to sue
>     > your government over attacks on you resulting from your country's ccTLD
>     > private keys being compromised.  At best some may be able to avoid some
>     > losses when their counter-party is also operating in the same country,
>     > but only entities other than their government will be taking the
>     > losses.
> 
> "I relied upon the trust anchor my government provided me, so, your Honour, I
> am not guilty"

I was referring to the government's civil liability.  For an
individual's liability, especially criminal liability, no doubt this is
(would have to be) a defense.