Subject: RE: Certificate / CPS issues

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sun, 8 Jun 2003 19:05:09 -0700

> Yes, I'm sure those guidelines are all well and good and 
> clearly thought out.
> The problem is that what actually gets *LEGISLATED* may be a 
> totally different
> story 

Well why not go and find out rather than raising a theoretical
problem that probably does not exist?

Most of the digital signature legislation was passed four or five
years ago.

	Phill

---

From: Bob Braden <[email-masked]>
Date: Sun, 8 Jun 2003 20:09:29 -0700 (PDT)

*> From [email-masked]  Sun Jun  8 18:27:12 2003
  *> From: "Hallam-Baker, Phillip" <[email-masked]>
  *> To: "[email-masked]'" <[email-masked]>
  *> Subject: Re: Certificate / CPS issues 
  *> Date: Sun, 8 Jun 2003 18:16:32 -0700 
  *> MIME-Version: 1.0
  *> X-AntiVirus: scanned by AMaViS 0.2.1
  *> 
  *> Lets try a thought experiment. Imagine for a moment someone came to this
  *> forum in 1990 proposing say lossy packet routing could never possibly work
  *> because nobody could rely on such a system, pointing out that the Internet
  *> was minute compared to the telephone system and that therefore the Internet
  *> could never possibly be built. Furthermore the fact that the OSI networking
  *> stack was poorly specified and X.500 would inevitably fail meant that the
  *> Internet could not possibly work.
  *> 

Actually, in 1990 a vocal set of people *were* saying exactly those
things.

Bob Braden

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 9 Jun 2003 03:07:41 -0700

Bob,

Yes I know, but how many of the vocal minority were pointing to the IPv4
addrss space issue as the achillies heel?

Pki works if you know how to make it work. The fact that some in this forum
don't know how to make it work for free does not devalue the concept.

The ietf is doing a good job these days on avoiding insecure protocols. It
is doing a lousy job creating secure protocols that can be used by real
people.

The perfect is the enemy of good security

 -----Original Message-----
From: 	Bob Braden
Sent:	Sun Jun 08 20:09:35 2003
To:	[email-masked]; [email-masked]
Subject:	Re: Certificate / CPS issues

  *> From [email-masked]  Sun Jun  8 18:27:12 2003
  *> From: "Hallam-Baker, Phillip" <[email-masked]>
  *> To: "[email-masked]'" <[email-masked]>
  *> Subject: Re: Certificate / CPS issues 
  *> Date: Sun, 8 Jun 2003 18:16:32 -0700 
  *> MIME-Version: 1.0
  *> X-AntiVirus: scanned by AMaViS 0.2.1
  *> 
  *> Lets try a thought experiment. Imagine for a moment someone came to
this
  *> forum in 1990 proposing say lossy packet routing could never possibly
work
  *> because nobody could rely on such a system, pointing out that the
Internet
  *> was minute compared to the telephone system and that therefore the
Internet
  *> could never possibly be built. Furthermore the fact that the OSI
networking
  *> stack was poorly specified and X.500 would inevitably fail meant that
the
  *> Internet could not possibly work.
  *> 

Bob Braden

---

From: "Christian Huitema" <[email-masked]>
Date: Mon, 9 Jun 2003 17:32:47 -0700

> I dispute the lower risk claim. You have more control. More control
does
> not mean less risk.

The PKI and the PGP model both have risks, just different risks. The PGP
model only involves the two parties; it brings the risk that the two
parties misidentify each other.  The PKI model involves a third party,
supposedly trusted by both players; it brings the risk that the third
party may make mistakes, or that the two parties mistakenly assign too
much trust to a third party. Also, any large centralized service is
bound to become a target for government and other entities.

-- Christian Huitema

---

From: "Haren Visavadia" <[email-masked]>
Date: Wed, 11 Jun 2003 08:16:50 +0100

> Which one?

According to Al Arsenault:

> a number of the entities behind those trusted roots go out of
business, or become somebody else, or...  A quick quiz, > based on the
root certs from IEv6 (yes, I know the answer to these questions, but
I've been working in the PKI area  > for over 15 years - how about most
people):
>
>    - who owns the private keys associated with those 3 "GTE Cyber
Trust" root certificates?
>    - what is that company doing that will conclude by June 30?
>    - what about the private keys associated with those four "Equifax
Secure" root certificates?
>    -  there are at least 10 trusted root certificates marked signed by
"DST".  What happened to DST?
>    - there are six certificates marked as being from "Thawte".  Who's
"Thawte"?
>    - what about Xcert?

---

From: "Haren Visavadia" <[email-masked]>
Date: Wed, 11 Jun 2003 13:40:05 +0100

>Antitrust refers to prevention of abuse of monopolistic dominance of a
>market; it has nothing to do with trust in the sense

It is factor that contributes to building trust.

---

From: "Haren Visavadia" <[email-masked]>
Date: Thu, 12 Jun 2003 15:39:02 +0100

> Not in the PKI sense

PKI only works when there is trust.

If you think "Rather a matter of apples and oranges, in my view." you
are very blind to the trust element and its importance. I know you would
even trust the Soviet Union.