At 5:53 pm +0900 2000-12-28, sen_ml(_at_)eccosys(_dot_)com wrote:
... the points i wish to make are:
-expiring keys from keyservers is not necessarily a bad idea -- at least
your example does not convince me that we would be significantly worse
off than the current situation.
Keys are dime-a-dozen: expiring them is economical. People, OTOH,
are valuable, so it's better to expire the keys, but not the people.
i like Dave Del Torto's statement:
Storing your key on a public keyserver is a privilege, not a right.
If you can't do the most basic things to maintain it, you're not
doing anyone any good, least of all yourself if you want people to
use it.
You must also be EMPOWERED to do basic key maintenance on your public
key. The people who might want to use your key may not not always be
friendlies. Spammers are only the tip, albeit a sharply annoying one,
of the iceberg. There are more dangerous threads being woven.
What we're really discussing is the building of standards that users
will control or standards which will help control them. Keys are good
for authentication, and can even protect identity (if the anonymix
allows). But the uncontrolled, irresponsible use of powerful tools
like the PGP trust model also makes keys great for traffic analysis
and collecting rosters of cryptographically-bound dissidents. The
structures are in place to collect names: are you implementing
technology that makes that scale better?
Until we build ourselves total control over our keys' public
attributes and visibility, we're not really being empowered by our
crypto (possibly the opposite). It's hard to get the average user to
unlearn things. Given the current key formats and the way keyservers
work, not building full user control over all attributes of their own
keys on servers amounts to a very bad habit to get the crypto user
community into.
Let's keep in mind that we've been asked at a recent IETF plenary
whether or not the IETF should support wiretapping technologies in
standards. Those kinds of trial balloons are only the first at the
nexus of human rights and security technology. Technologists have the
opportunity now --not later-- to establish a positive direction with
standards and implementations or hand the rudder over to corporations
and politicians. Ignore this, and these one-way functions are going
to double back and bite us on the *ss. If Oppenheimer or Einstein
were alive today, they'd agree that we should luxuriate in this
discussion now and improve the infrastructure ASAP.
Ask yourself why no major implementor has jumped on the Stealth
bandwagon in the last 6+ years? Is the fact that RFC2440's
speculative keyids remain unimplemented an indication of complacency
in the crypto community?
Who's holding us back?
dave
__________________________________________________________________________
"The average age of the world's greatest democratic nations has been 200
years ... from bondage to spiritual faith, from faith to great courage,
from courage to liberty, from liberty to abundance, from abundance to
complacency, from complacency to selfishness, from selfishness to apathy,
from apathy to dependency, and from dependency back again into bondage."
-- Lord Macaulay (1857)