ietf-822
[Top] [All Lists]

Re: Draft for signed headers

1999-03-18 10:10:29
PLEASE CROSS POST THESE DISCUSSIONS TO BOTH LISTS.

In <19990317191343(_dot_)15313(_at_)main(_dot_)templetons(_dot_)com> Brad 
Templeton <brad(_at_)templetons(_dot_)com> writes:

On Wed, Mar 17, 1999 at 03:49:28PM +0000, Charles Lindsey wrote:

In 
<Pine(_dot_)LNX(_dot_)3(_dot_)96(_dot_)990316163415(_dot_)26423F-100000(_at_)lazy(_dot_)techos(_dot_)skynet(_dot_)be>
 Jean-Francois Stenuit <jfs(_at_)skynet(_dot_)be> writes:


The reasons may be different, but the mechanisms can be the same.

The chief reason for having the same mechanisms is that articles may get
gatewayed from news to mail, or vice versa, and one wishes the signature
mechanisms to survive the transition so far as may be possible.
I don't think that's an attainable goal, laudable as it may be, and as
such I will advise against major effort being spent on it.

If it is laudable, then we should make all reasonable efforts to achieve
it. It the mail gurus don't want to play, then the Usenet people can go it
alone. But even then, we need to make it gateway proof if at all possible.

E-mail groups are already way ahead of us in working out E-mail signature
schemes.  All the competing schemes, however, are not really workable
inside USENET.

In addition, any signature scheme will have a "certificate space" where
certifying keys are expected to be known and respected.  It's far from
sure that we can overlap the spaces of USENET and E-mail in this area.

No. My Draft carefully left it up to each 'application' as to how
certificates were distributed. Insofar as signing Usenet Control messages
is an application (the main/only one on the table so far) then we may well
define an infrastructure for that purpose. In the absence of specific
applications, people will presumably have to get certificates from the
usual PGP servers and decide for themselves how much of the web-of-trust
to believe.

While it's true that the most common USENET certificate will simply
say "This keyholder is entitled to act as E-mail address 
foo(_at_)bar(_dot_)com" and
that is in common with an E-mail certificate's goals, the truth is all
the E-mail certificates are *huge*, far too large to be used in USENET.
(many exceed the average length of a USENET message!)

Howevever, that doesn't meant they can't interoperate.  The way they
would is either a gateway that re-signs a message and says, "I checked
the sig from the other system, and I now sign using our system that it
was valid.  If you trust me, and you trust the other system, you can trust
this message."

That is a messy solution to be avoided if possible. Nevertheless, my draft
makes provision for that where necessary.

Or more commonly, one can get one's certificate mapped.  So if you have
an E-mail certificate certifying your E-mail address, you don't use it in
your USENET postings, instead you ask a CA to convert it into a USENET
E-mail address certificate, and you use that.

If E-mail systems had a system under proposal with a decently sized
certificate that met USENET needs, that would be great, but it ain't
happening.

-- 
Charles H. Lindsey ---------At Home, doing my own thing------------------------
Email:     chl(_at_)clw(_dot_)cs(_dot_)man(_dot_)ac(_dot_)uk  Web:   
http://www.cs.man.ac.uk/~chl
Voice/Fax: +44 161 437 4506      Snail: 5 Clerewood Ave, CHEADLE, SK8 3JU, U.K.
PGP: 2C15F1A9     Fingerprint: 73 6D C2 51 93 A0 01 E7  65 E8 64 7E 14 A4 AB A5

<Prev in Thread] Current Thread [Next in Thread>