Subject: RE: Comments on draft-ietf-pkix-ac509prof-05.txt

From: Carlisle Adams <[email-masked]>
Date: Mon, 16 Oct 2000 11:21:22 -0400

Hi Polar,

> ----------
> From: 	Polar Humenn[SMTP:[email-masked]]
> Sent: 	Monday, October 16, 2000 10:48 AM
> To: 	Al Arsenault
> Cc: 	[email-masked]; Carlisle Adams; [email-masked];
> [email-masked]; [email-masked]; [email-masked]; Stephen McConnell; Kent
> Salmond; Ken Mccoy; Thumrongsak Kosiyatrakul; Susan Older; Shiu-Kai Chin
> Subject: 	Re: Comments on draft-ietf-pkix-ac509prof-05.txt
> 
> I thought it was the case as well, that the AC can really bridge three
> PKIs. That means the holder, the AA, and the RP all can have their own
> different PKIs with the possibility of cross-certification of all three. 
 
As I mentioned before, as soon as you allow (proper) cross-certification of
all three, you no longer have three, but one.  This is what makes the model
work.

> I don't even see a need for cross certification in the model. My browser
> "trusts" 137 root certificates without cross-certification, and nobody
> seems to care all that much.
 
A number of people have been saying for a long time now that the Web model
(with dozens of "trust anchors" in your software that you've never even
heard about) is NOT a good model for security.  I wouldn't quite say that
"nobody seems to care all that much".  If you look at the organizations
operating PKIs today that care a lot about security (governments and
financial institutions, in particular, but others as well), most of them do
not rely solely upon the browser software for security in their
authentication decisions.

> Well, at the very least, I'm glad that some people in the group actually
> see the problem. Whether it amounts to anything significant, I can only
> hope.
 
Yes, I think people see the problem.  Furthermore, I've outlined the
conditions under which it is not a problem.  These conditions (a single PKI,
formed through responsible cross-certification) are not overly restrictive
and make perfect sense for interoperation between domains that care about
security, especially since they need to do this anyway in order to
authenticate each other.

Carlisle.

---

From: Polar Humenn <[email-masked]>
Date: Mon, 16 Oct 2000 12:25:56 -0400 (EDT)

Hi Carlisle,

> security, especially since they need to do this anyway in order to

But this condition of operation for the AA still hinges on the fact that
the DN space MUST be unique after cross certifying PKI's.

Can you really see that happening?

I cannot see that happening in the real world. Especially with many
players, and especally when you need to do things quickly. Forcing one
organization or both to comply with the other, is a lot of work, and
figuring out name constraints for both could be a daunting effort, not
mentioning getting it correct.

Cheers,
-Polar

> Carlisle.

-------------------------------------------------------------------
Polar Humenn                  Adiron, LLC
mailto:[email-masked]       2-212 CST      
Phone: 315-443-3171           Syracuse, NY 13244-4100
Fax:   315-443-4745           http://www.adiron.com