Re: [saag] Or grow a real PKI (Re: SHA-1 to SHA-n transition)

A PKI does not grow of its own accord. The SSL PKI only exists because there was a clear business driver that drove its deployment.

That is not to say that it is impossible to deploy an alternative design. Only that it is necessary to model and understand the real world deployment constraints and design for deployment.

And the biggest mistake most designers make is to over-estimate the extent to which security is actually desired. As far as actual end users are concerned the SHA-n transition issue is irrelevant, it is even irrelevant as far as the banks and so on are concerned. Everyone else in the system expects 'the boffins' to come up with a fix that won't require them to do too much. In particular, they don't want a solution that might require them to actually think.

The only way that an imminent crisis can lead to large scale concerted action is if (1) the underlying technical issue is simple enough for anyone to grasp and (2) those required to act have other motives for action. The reason that the Y2K scam was so successful was because it enabled a clique of mediocre corporate VPs to engage in empire building. After a short while the scam became self-perpetuating because the first act of a Y2K vampire was to send out letters to every supplier demanding proof of Y2K certification - and so the infection was spread.

You do not need to be an economist or apply fancy algebra to understand the effects of economic processes. If we are not prepared to try to understand the economists, why should the economists attempt to understand us?

-----Original Message-----
From: saag-bounces@ietf.org on behalf of Nicolas Williams
Sent: Mon 3/2/2009 3:56 PM
To: Jeffrey Hutzelman
Cc: der Mouse; saag@ietf.org
Subject: [saag] Or grow a real PKI (Re:  SHA-1 to SHA-n transition)

Perhaps the simplest fix, technologically speaking, would be to get a
real PKI -- no technical changes needed, just political ones.  But that
strikes me as politically infeasible.

A real PKI would imply:

 - trust anchor regulations
 - CA and DNS registrar regulations that work

Seems unlikely.
_______________________________________________
saag mailing list
saag@ietf.org
https://www.ietf.org/mailman/listinfo/saag