Subject: RE: Scale (and the SRV record)

From: Alan Lloyd <[email-masked]>
Date: Fri, 30 Oct 1998 09:16:41 +1100

HMMMMMMMMMMMMMMMM!

> -----Original Message-----
> From:	Phillip M Hallam-Baker [SMTP:[email-masked]]
> Sent:	Friday, 30 October 1998 6:55
> To:	[email-masked]
> Cc:	[email-masked]
> Subject:	RE: Scale (and the SRV record)
> 
> 
> 
> > >If someone spoofed DNS the worst that would happen is that I would
> > >recieve a certificate I didn't trust (and would ignore) or no 
> > >certificate
> > at all.
> > 
> > Well, if you're only fetching certificates, probably.
> > 
> > But if you're fetching CRL's, then no.  Suppose a cert is
> compromised,
> > and CRLn is issued before the "next update" time purely because of
> > that compromise.  The adversary could spoof DNS and just send out
> > the valid, but outdated CRL(n-1) and potentially have quite a
> > window of opportunity.
> 
> Hence the motivation for an Online Status service like OCSP.
	[Alan Lloyd]  Please enlighten me.
	Companies make telephones based on the fact that there is a
distributed telephone network (switching infrastructure) out there that
supports global numbering and common protocols.

	I thought that as X.509, certs, crls and CAs as used in PKIs are
part of globally named (or within a domain) named objects that reside in
a directory service (X.500), that those building PKIs would use the
distributed information infrastucture to support such functions. Not re
invent the infrastucture by disjoint mechanisms.

	I hear the words Meta certs, OCSP, but what is the distributed
information infrastructure that supports it?
	How is this modelled, how does it scale, who builds the clients,
what is the knowledge and configuration issues. How does a recipient
client know when it receives a signed message that one of the many OCSP
servers it knows about is responsible for validation or validation is
via the directory service. Do OCSP servers connect to the directory
service.... What is the SYSTEM (that scales) and whats the Business
level Information design . How does the OCSP architecture (what ever
that is) fit in with business service delivery?

	There is a difference between a "protocol mechanism"  to a
"server" and a directory service.

	regards alan
>   Alternatively use the OCDP mechanism to provide a 'meta CRL'. A
> master
> CRL can be issued every minute which would contain a list (CRLList) of
> 
> the most current CRLs in each partition.
> 
> This issue is orthogonal to the issue of directory discovery however.
> Any infrastructure for distributing CRLs has the same problem. I don't
> see that the solution is to attempt to guarantee delivery of the CRLs
> by hypothesizing secure infrastructures will be installed. I believe
> we should address the issue by removing the dependence.
> 
> 
> 		Phill

---

From: "Phillip M Hallam-Baker" <[email-masked]>
Date: Thu, 29 Oct 1998 19:19:02 -0500

> supports global numbering and common protocols.

The Internet is not like a telephone service. It is a network of networks
and not a network.

The differences between the circuit switching infrastructure of the
telephone system and the packet switching infrastructure of the Internet
are significant and fundamental. The telephone system is optimized for
voice, not data. As the role of data networks increases it is the
telephone infrastructure which is being absorbed into the data network
and not vice versa.

Don't try to re-fight the OSI vs IP protocol stack wars. This is not
the place to do that. You might as well advocate gun control in talk.guns
or go to a Klu-Klux-Klanbake and advocate racial tollerance. Nobody is 
arguing that directories do not have an important role in the Internet. 
But you seem to have to insist that everything that could be done by 
a directory SHOULD indeed MUST be done by one or it will fail to meet 
the catalog of noise word criteria you state.

I don't think you are doing a very good job of being an advocate for
directories. When you lump them together with terms that are so overused
as to be meaningless marketing noise I suspect that many people will
dismiss directories as another sales pitch hype which will promise 
everything but deliver little: Object oriented - Isn't everything?
Scale - in whose laboratory? Oh its a pitch for a directory and it 
will solve all my problems - I'll buy 3, make that 4 if it will also
solve my Y2K. Do you support OpenGenera?

The directory plays a very specific role in a PKI as a repository of
signed objects. It does not create signed objects, it does not vouch
for their trustworthiness. It does not replace DNS. How the directory
system manages its bits is its own affair. It is not the concern of 
the PKI except that the PKI must not rely on the directory service to
fulfil expectations it is not capable of meeting.

There are roles for other types of PKI components but they are not
called directories. They may share parts of the code base, they may 
re-use the protocols but it is not usefull to call everything a
directory just because as Dilbert and Wally said 'we always build 
a directory', 'we like directories'[1].

		Phill

[1] I know it was actually a database.