Re: [saag] post-X509 cryptographic identities

On Tue, Feb 11, 2020, 7:31 AM Tony Rutkowski <trutkowski.netmagic@gmail.com>
wrote:

> Hi Derek,
>
> The market was a minor factor.  PKI invokes more legal and public policy
> considerations than probably any other electronic communication sector.
> It emerged as a governmental platform for trusted identity management
> and was pursued in intergovernmental bodies with links into treaty
> instruments.
>
> The ILPF very quickly came to focus almost exclusively on PKI in work
> led by Stewart Baker who had just left as NSA's GC. Verisign's early
> hire was Michael Baum who as Vice President of Practices and External
> Affairs, helped enable the marketplace by dealing with legal issues, and
> played a major role in getting PKI accepted worldwide. (Acknowledgement:
> I was also a VeriSign VP and a lawyer.)
>
> PKI is a fundamental part of the EU's regional security strategy, as it
> is in most nations.  PKI implementations also dramatically shape
> marketplace competition - a subject now of rather intense scrutiny on
> both sides of the pond - and culpability extends both to individuals and
> standards bodies.
>

Let's actually look at the dominant by order of magnitude application of
the PKI, namely authenticating servers identified by domain names.

The authoritative information is in the DNS. The CA system is only an extra
point of failure here, which is why things like DANE are promising.

None of the extensions like policy mapping etc.  matter.

>
> --tony
>
> On 2020-02-11 9:40 AM, Derek Atkins wrote:
> > On Tue, February 11, 2020 9:26 am, Michael Richardson wrote:
> >> Derek Atkins <derek@ihtfp.com> wrote:
> > [snip]
> >>      > Should this document also include the history of other PKIs,
> such as
> >> SPKI
> >>      > and/or OpenPGP's WoT?  I think it would be interesting to put an
> >>      > historical contrast on the visions behind the various
> >> methods/standards
> >>      > and perhaps try to document the reasons (if possible) that
> "market
> >> forces"
> >>      > took us in one direction vs another.
> >>
> >> Yes, I think that it has to.
> >>
> >> Each evolved either as a response to X509.  Restating 2692/2693 or the
> >> design
> >> requirements for OpenPGP is not called for; distilling what criticism
> were
> >> in
> >> common and why SPKI did not fly is important.  And is there something
> >> technical wrong with OpenPGP, or are we dealing with implementation
> >> issues?
> > My personal opinion is that it was neither a technical issue nor an
> > implementation issue that caused the market to choose X509 vs OpenPGP,
> but
> > rather a philosophical issue (or perhaps business-money-making choices).
> >
> > On the other hand, if we're going to rehash the design requirements for
> > X.509, I think it makes sense to also rehash the differences in
> > requirements for SPKI and OpenPGP (and maybe even DNSSec).  Specifically,
> > it's important to discuss how they differed, but also in what ways they
> > overlapped.  I do agree we don't need to go into the full history of all
> > of them (including X.509).
> >
> > Again, this is just my opinion from someone who was deep in the trenches
> > back in the 1990s.
> >
> > -derek
> >
>
> _______________________________________________
> saag mailing list
> saag@ietf.org
> https://www.ietf.org/mailman/listinfo/saag
>