ietf
[Top] [All Lists]

Re: Multiple roots & E2E PKI trust discovery, chain management & capabilities exchange

2005-07-22 13:54:59
Stephane Bortzmeyer wrote:
On Fri, Jul 22, 2005 at 10:08:03AM -0400,
Francois Menard <francois(_at_)menards(_dot_)ca> wrote a message of 42 lines which said:

  You, not everybody
  v

I would for example not trust .travel from new.net if ICANN had assumed control over .travel ... I should be able to pick this from a PKI-based P2P trust chain, would I not?


Since other people would have a different trust chain, this will be a
significant move from the current semantics of the DNS. Today,
"airfrance.travel" is the same for me and for you. With your system,
they may be different.

I do not say that it is good or bad, just that it is a different
system than the one users are accustomed to.


I say it would be very bad. It would create golden opportunities for
fraud and deception, quite apart from immense confusion of the general
public.

[The fact that two versions of the same name were both cryptographically
connected to their respective roots wouldn't in the least prevent
fraud and confusion - it would rather give a fraudulent site a spurious
appearance of authenticity.]

Also, pity the poor computers. Humans might just be able to navigate
in a world of ambiguous names, but computers can't. Don't forget that
the uniqueness property of a domain name is used to guarantee uniqueness
in other, derived, namespaces, so it isn't only the direct use of DNS
that would be broken by ambiguity. XML namespaces would be broken too,
for example.

I wouldn't change a word in RFC 2826.

   Brian


_______________________________________________
Ietf mailing list
Ietf(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/ietf