Re: [saag] post-X509 cryptographic identities

[Michael Richardson <[e-mail]>]

Nico Williams <[e-mail]> wrote:
    >> and in particular it would permit: or: Russia's nameservice
    >> cryptnector.com (national DNS root) or: employer.example.com's
    >> www.amazon.com (forced corporate proxy)

    > Sure, but PKIX let's you have this too: it's just an alternate issuer
    > (root).

    > What would SPKI have given us, really?

No, PKIX does not have an alternate issuer.
That's outside of the PKIX.  It's another instance of PKIX.
What SPKI gives is the alternate roots are explainable and codifiable within
the system, rather than making it an externality.  

    >> In the SPKI days I wanted no DNSSEC root.  I wanted 158 national roots
    >> with k-of-n cross-signatures.

    > Cross-signing roots ~= a root anyways.

    > Every country could run its own roots with mostly or entirely the same
    > contents as all the others.  From a relying party's point of view,
    > there's a single root, and _that_ is what matters.

This would almost be the same thing, except for the liability and soveignty issue.

    > (A relying party might need to change root trust anchors when traveling
    > if they are forced to or want to change roots.)

Yes, possibly.  It's definitely an open question, and there is a tussle there.

    >> Which definitely lets my government spoof me, which they already say
    >> they have the right to do under certain circumstances, but it doesn't
    >> let them spoof you.  Would we have to kill ".com", etc. and all the
    >> ICANN zoo?  Maybe. It's not a big loss to me, but others would object.
    >> And we don't need to do it overnight.

    > Yes.  But if governments won't force you to do this, I don't mind.
    > That is, we can have a single-root PKI (or a cross-signed root if you
    > prefer) in all cases.  And we can have mandatory or optional use of
    > ccTLDs.  It's all good.

The carrot could revolve around liability.

    >> It also means that my government is assuming liability if I get
    >> spoofed, which also seems reasonable.

    > Sovereigns always immunize themselves.  You will not be able to sue
    > your government over attacks on you resulting from your country's ccTLD
    > private keys being compromised.  At best some may be able to avoid some
    > losses when their counter-party is also operating in the same country,
    > but only entities other than their government will be taking the
    > losses.

"I relied upon the trust anchor my government provided me, so, your Honour, I
am not guilty"

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works        | network architect  [ 
]     [e-mail]  http://www.sandelman.ca/        |   ruby on rails    [