ietf
[Top] [All Lists]

Re: Global PKI on DNS?

2002-06-20 00:30:17
? >  > Well, we agree on the utility of having multiple PKIs. We disagree on
? >>  the need for a PKI that happens to cover a specific name space that
? >>  underlies the vast majority of IP-based communications, or at least
? >>  you disagree on the desirability of that specific PKI given the
? >>  reality of who runs which TLDs. But, you don't offer any suggestions
? >>  on how to address the need that a DNS-based PKI satisfies.
? >
? >I don't see it as a 'need' in that sense.  If you want to increase
? >the level of trust over the current situation, you pretty much have
? >to either exchange keying material directly with that party,
? >or pick a third party that *you* trust to serve as an intermediary.
? >It's really hard to have multiple intermediaries because you need
? >to trust them all.  And just because someone runs a TLD doesn't mean
? >that you want to trust them - it often means you should be wary of them.
? 
? direct exchange obviously does not scale well, and picking a third
? party gets into the trust problem all over again, as well as
? requiring that BOTH you and the other correspondent trust.

there are lots of third parties that pairs or small groups of us
trust for limited purposes.

there are no third parties that we all trust for all purposes.

? >It really doesn't have much to do with DNS - the problem is that
? >real trust doesn't scale to that level no matter what the naming
? >scheme or the protocol.
? 
? Your later message clarified this, i.e., you believe that in general
? one cannot identify a third party who enough people trust to act as a
? CA for a large set of people. I argue that we are have learned to
? accept organizational entities as authoritative issuers of
? credentials all the time and that this is no different. 

yes we do this *frequently*, but not "all the time" as in "we all
trust the same third party in every instance"

This is not a
? suggestion to have only ONE PKI for everything. It is a suggestion to
? have exactly one for the purpose of securely binding DNS names to
? keys. 

part of the problem is that they're not just names - we bind other 
things to those names.  another part of the problem is that 
the meanings assigned to those names are subject to change without
our knowing about that.   another part of the problem is that 
TLDs have demonstrated that they're not trustworthy even given
their current responsibilities and power - so you're proposing
investing even more trust in them.

? If you are afraid that people would come to rely on this one
? too much, and that it would deter other PKIs from being formed, maybe
? that's an indication that it would be more valuable that you care to
? admit :-)

lots of people believe in superstitions too, but that doesn't mean that
they're useful to those people.

Keith



<Prev in Thread] Current Thread [Next in Thread>