Subject: RE: Scale (and the SRV record)

From: "Larowe, Rick" <[email-masked]>
Date: Thu, 05 Nov 1998 07:07:24 -0500

> -----Original Message-----
> From: Stephen Kent [mailto:[email-masked]]
> Anyway, didn't thin clients become less of a goal with the 
> demise of netPCs
> :-)?  All of the software on my desktop and laptop machines is getting
> bigger each year, not smaller.

But let's not forget about PDAs, smart phones, pagers, and even 
watches.  They'll be the next targets. 

-rick
-----------------------------------------------------------------
Rick LaRowe
GTE Internetworking  -  CyberTrust Solutions, Inc.            
77 "A" Street,  Needham, MA   02194-2892  
781-455-5970 (voice)  781-455-3105 (fax)
[email-masked]

---

From: Stephen Kent <[email-masked]>
Date: Thu, 5 Nov 1998 18:43:15 -0500

>watches.  They'll be the next targets.

Good point, but I'm loathe to skew the current model for the benefit of
some of these devices.  The PDAs are getting pretty powerful; phones and
pagers do pose more of a problem.  I'm not worried about my watch needing
to validate the cert for WWV.  If we go down this path too far, we might
next decide to create "lite" certs because regular X.509 certs are too big,
have uncessarily complex name forms, etc.  People sometimes tell me that
every lightbulb in my house needs to have an IP address and that's why IPv6
needs to be deployed. Maybe not.

Steve

---

From: "Perry E. Metzger" <[email-masked]>
Date: Fri, 06 Nov 1998 13:57:33 -0500

Stephen Kent writes:
> to validate the cert for WWV.

On the other hand, you should be worried about your pacemaker getting
commands from anyone other than an authorized source.

Within less than ten years, desktop machines are going to start
dissolving with mobile platforms becoming universal. Those that skoff
at this are suffering from "Vannevar's Syndrome" -- the inability to
notice already extant technology (named for Vannevar Bush's famous
gaffe where he predicted water cooled vacuum tube computers the size
of skyscrapers substantially after the transistor was already
invented.) The proofs of concept are already out there.

Right now, you can pack virtually the entire functionality of a
substantial desktop computer into a pack of cigarettes. People don't
do that largely because keyboards, CD-ROM drives and displays get in
the way, so they just build "laptops". Given chord keyboards and
eyeglass displays, or voice i/o, or one of a dozen other things, the
issue of keyboards and displays goes away. Given a multi-megabit
constant mobile internet connection (see the current W-CDMA proposals
which are already being pushed by serious companies) you no longer
will really need the CD-ROM (and probably don't need it now.)

In a decade or maybe fifteen years, we're still going to have an
internet and still going to need digital signature technology, but the
end points are generally going to be things attached to people which
are almost unnoticeable in size. I do not believe we actually need to
alter the models we are working with, but if it turned out that we
*did* need to alter those models to fit mobile applications, it would
be foolish to think that we were "skewing the model to deal with rare
devices" given that these devices will not be rare for long.

Perry

---

From: David Sweigert <[email-masked]>
Date: Fri, 06 Nov 1998 16:55:35 -0500

This brings up the question of tactical PKI; or digital certs 
that are "lightweight" -- 1/10th the size of a X.509v3 cert.

Dave

---

From: "Phillip M Hallam-Baker" <[email-masked]>
Date: Mon, 9 Nov 1998 12:00:57 -0500

> that are "lightweight" -- 1/10th the size of a X.509v3 cert.

Please no! We have explored that particular rathole more than once.

Four years back before there was a large deployed base of X.509v3 on
the Internet the question of encoding format was an open one. Today
there are many toolkits available which perform parsing. The path of
least resistance for an implementer is now to use CAPI or one of the 
numerous third party toolkits.

I don't think the 'handheld' argument is compelling. Having written
a number of X.509 encoders and decoders I don't see writing a 
compact decoder as being much of a problem. If you are willing to
accept a very narrow profile of the PKIX profile a table driven 
decoder can be written in about a Kb of code.

If you profile PKIX very narrowly you can have a certificate with
just the issuer and subject names, a policy attribute and the subject 
key. The overhead over the public key bits being perhaps 100 bytes.

I don't see how a certificate 'a tenth the size' of such a 'liposuctioned'
PKIX cert is going to be possible. The problem with ASN.1 BER and DER
is not the compactness of the representation.

		Phill