On Thursday 21 October 2004 04:01, Hironobu SUZUKI wrote:
"X.509 is a standard". It is true because we have no any alternative
choice for CA service in OpenPGP. It is hard to make OpenPGP CA
service because there is no trust model with certificate authority in
OpenPGP.
Actually, all the necessary flags are there:
section 5.2.3.12 Trust Signature (can be used for sub-CA signature).
section 5/2.3.14 Revocation Key (necessary for some strictly hierachical CA
models).
section 5.2.3.20 Key Flags:
0x01 - this key may be used to certify other keys (read: Sub-CA)
0x02/0x04/0x08 - this key may be used to sign/encrypt data (read: user key)
0x10 - key escrow (minefield warning: partly patented by PGP Inc.)
0x80 - group key
All that is left to do is:
* implement support for this model in OpenPGP aware products
* issue a list of trusted CAs (public keyring) suitable for your application
Konrad
pgpKXyfnqymxw.pgp
Description: PGP signature