Subject: RE: Software for PKI

From: [email-masked] (Peter Gutmann)
Date: Thu, 8 Nov 2001 11:35:51 +1300 (NZDT)

"Bob Jueneman" <[email-masked]> writes:

>Finally, another blunder within the PKIX community was in avoiding making a
>firm commitment to use directory technology to distribute certificates, while
>at the same time not espousing any other workable solution either, such as
>some kind of an http mechanism.

Actually I have an RFC draft which proposes a very simple, easy-to-implement
web-based cert distribution system.  It was rejected with the comment "We don't
want to turn PKIX into PGP" (which I translate to "We're going to keep it hard
to implement and hard to use, dammit!").

Peter.

---

From: Michael Ströder <[email-masked]>
Date: Thu, 08 Nov 2001 11:12:40 +0100

> to implement and hard to use, dammit!").

My suggestion once was to run LDAP servers with dc-style naming and
locate the LDAP server for a given e-mail address in DNS by SRV RR.
This also did not attract the X.500-inspired people here who are
still dreaming of a globally working X.521 name space.

Ciao, Michael.