Re: [stir] current draft charter

[Dave Crocker <[e-mail]>]

On 6/12/2013 3:21 AM, Stephen Farrell wrote:
> That's a fair point. However, I'd argue that the difference between
> a DKIM-like and RPKI-like approach is far from just syntax. For
> example, in an RPKI-like approach the callee has to verify who
> delegated what to whom in order to check the signature (e.g. via
> 5280 NameConstraints). With a DKIM-like approach, that's done in
> some un- or differently-specified way by some infrastructure (before
> making the public key available) and isn't directly visible to the
> callee. That's definitely not just syntax I reckon.


My simplistic description of the DKIM-like model is that the storage 
location constitutes the cert.

The semantic of the cert is "the owner of this location authorizes use 
of the key".  Since the 'location' is a place in the DNS, the owner of 
the domain name at that location is validating use of the private key.

For very simple cert semantics like this, it works.  Semantics that are 
more complex probably won't.

d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net