[TLS] Re: Russ Housley: Fwd: problems with draft-ietf-tls-openpgp-keys-10.txt

On Wed 28 Jun 2006 15:48, Stephen Kent wrote:

> >How would you support this?
> Each relying party is allowed to select the CAs that it views as
> trust anchors. As a result, different RPs may have differing views of
> the same PKI.  Because a CA may have its key cross certified by
> multiple other CAs, it is possible to create cert paths that
> terminate at different trust anchors, depending on what TAs a given
> relying party selects. All of these observations say that X.509 and
> PKIX are NOT strictly hierarchic.

Ok I see your point. I also noticed that hierarchical is used in several 
RFCs, to specify a specific form of hierarchy. So since this term is 
already common for this, would something like the following change
address your concerns?

   At the time of writing, TLS [TLS] uses the PKIX [PKIX]
   infrastructure, to provide certificate services.  Currently the PKIX
   protocols are limited to a structured certification model where only
   specific participants, the Certificate Authorities, are allowed to
   express trust. As a result, applications which follow more complex
   trust models, such as the web of trust, could not be benefited by  
   TLS.

> >RFC2818 is a document that proposes a way on how to use HTTP over
> > TLS. This is not the purpose of this document.

> TLS is the IETF version of SSL.  SSL, like PGP (vs. OPGP) was not
> born in a standards environment, but rather existed prior to IETF
> involvement. The description of how to use the ID data from an X.509
> cert to provide authentication for a web server is an important part
> of the semantics of SSL and TLS. 

I disagree with that. Why do I have to cope with HTTP? I didn't write
this extension to use openpgp keys with web browsers. Sure this could be
done, but then the ones that need this functionality should write the
rules. I am not interested in that.

regards,
Nikos

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls