Subject: RE: Client-side revocation checking capability

From: Warwick Ford <[email-masked]>
Date: Tue, 15 Aug 2000 16:31:39 -0700

Steve:

Seeing our corporate name used in vain here, I feel the need to correct a
misconception of the VeriSign business model that you are promulgating.  

VeriSign provides different types of PKI solutions in different
environments.  One model is the "TTP" model, which we feel has served the
community well for some purposes, such as public SSL server authentication.
However, we also operate extensive enterprise and service provider PKI
businesses, in which we enable other organizations to be their own CAs or
even to allow their customers to be their own CAs, through selective
outsourcing of particular PKI functions or through service-provider
technology platforms.

The concept of a "decentralized PKI" based on DNS is in not fundamentally
alien to our business strategy.

Warwick

> -----Original Message-----
> From: Stephen Kent [mailto:[email-masked]]
> Sent: Tuesday, August 15, 2000 1:31 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: Client-side revocation checking capability
> 
> 
> Lynn,
> 
> I agree that a PKI based on the DNS would be a great benefit to the 
> Internet. Now that VeriSIgn has bought NSI, the likelihood of 
> creating such a PKI seems remote, as it would create a decentralized 
> PKI that would challenge the VeriSign TTP model.
> 
> DNSSEC makes use of non-certificate constructs (for understandable 
> reasons having to do with DNS security details), that are not really 
> a good substitute for real certs.  Of course, you're a strong 
> believer in no certs at all, so I'm not surprised that you would find 
> DNSSEC a suitable alternative all by itself :-).
> 
> Steve
>

---

From: Stephen Kent <[email-masked]>
Date: Wed, 16 Aug 2000 13:59:31 -0400

Warwick,

>alien to our business strategy.
We agree that VeriSign supports several different PKI models. 
However, VeriSign, through its marketing arm, promotes the TTP model 
most aggressively, almost to the point of ignoring other PKI models 
that you support.  For example, last week the dirtector of operations 
for veriSig  was invited to address the Defense Science Board 
Information Assurance panel, in CA.  His briefing began with some 
marketing slides (for which he apologized). The PKI portion of those 
slides (the rest emphasized the scope of the NSI DNS business) were 
almost exclusively devoted to the TTP business, especially the web 
server aspect.  In fact, I had to raise the fact that VeriSIgn 
offered programs such as VeriSign Onsite to bring out the other 
aspects of the business.  So, while we agree that, from a technical 
perspective that VeriSign does offer more than just TTP services, the 
public perception, which has been cultivated by VeriSign, focuses 
almost exclusively on the TTP model.

Steve

---

From: Dennis Glatting <[email-masked]>
Date: Wed, 16 Aug 2000 16:10:08 -0700

> almost exclusively on the TTP model.

And, if you follow www.verisign.com/repository/RPA/, which is 
embedded in my Verisign personal certificate as a pointer to 
their CPS, you will find:

* You are responsible for deciding whether the 
  information in the certificate is relevant.

* If you are not a Verisign customer (e.g., 
  some dummy connecting to a Verisign certified 
  e-commerce site such as Amazon.COM), and you 
  want to check for revocation, then you must 
  agree to their CSP if you want to use their 
  online services.

So much for Section 1, Section 2, which covers CRLs, is equally 
interesting. However, Section 5 says, as a non-subscriber, that 
Verisign doesn't warrant certificate merchantability, fitness, 
or the accuracy of information. Then, of course, you won't hold 
Verisign liable in any way.

So I see little value in Verisign certificates, infrastructure, and
technologies; and any effort by Verisign to "secure DNS" of dubious
value and a bit frightening. 

Marketing, yo!