Subject: Re: A PKI for the Internet (was RE: Scale (and the SRV record))

From: [email-masked]
Date: Fri, 30 Oct 1998 15:48:03 -0800

while the current common certificate infrastructure model is SSL ... which
baiscally checks if the certificate has been manufactored by somebody in
the list of known certificate manufactors/issuers (aka CAs) .... the common
authentication model on the internet is logging on to the service provider.

This one is basically somebody signs up for an account and establishes a
password. When they want to use the internet ... they contact the router,
give their account name and proof of password. The router is likely running
something like radius ... in which case it forwards the account name and
password to an account authenticator.

For PKIX to address the most fundamental of internet authentication
requirements ... could involve the ISP issuing a relying party certificate
with just the account name (sidestepping liability and privacy issues). The
choice now would be would the ISP router accept the certificate
authentication at face-value ... or would it use a PKI flavor of radius to
contact an account authenticator .... for instance to have more timely
information on whether the account is in good standing.

This is possibly the most fundamental current internet requirement ... and
it illustrates again the extremely short step from relying party
certificates to the AADS model ... where if the account has to be touched
as part of the authentication/authoritization ... then it is easily shown
that shipping the certificate with the transaction is superfulous (if
somebody gives you a copy of something .... how many million times do you
have to send the same copy back to them ... before they realize that they
don't have to see the copy if they are already looking at the original
stored in the account record).