Re: [saag] post-X509 cryptographic identities

[Michael Richardson <[e-mail]>]

Derek Atkins <[e-mail]> wrote:
    > [snip]
    >> I think that the document would say a series of things:
    >> The designers of X500/X509 intended X, but it turned out that this
    >> did not happen, and instead PKIX did Y.
    >>
    >> (One could substitute X=DN, Y=SAN for instance)
    >>
    >> I think that it is important for any new identity system to recognize what
    >> forces pushed us away from the original vision.
    >> We made engineering tradeoffs based upon time, code, bandwidth,
    >> round-trips
    >> and threats.   Not every such decision is still justified.
    >>
    >> So this requirements document would essentially be some kind of loving
    >> criticism.

    > Should this document also include the history of other PKIs, such as SPKI
    > and/or OpenPGP's WoT?  I think it would be interesting to put an
    > historical contrast on the visions behind the various methods/standards
    > and perhaps try to document the reasons (if possible) that "market forces"
    > took us in one direction vs another.

Yes, I think that it has to.

Each evolved either as a response to X509.  Restating 2692/2693 or the design
requirements for OpenPGP is not called for; distilling what criticism were in
common and why SPKI did not fly is important.  And is there something
technical wrong with OpenPGP, or are we dealing with implementation issues?

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-