Subject: Re: Reverse paths

From: [email-masked] (Peter Gutmann)
Date: Fri, 21 Jul 2000 07:33:00 (NZST)

Steve Hanna <[email-masked]> writes:

>As to how you can display the network of trust in a mesh topology, X.500 DNs
>provide a nice hierarchy. Certificates are directional arcs between nodes in
>the tree. Trust anchors can be displayed as arcs from the RP to the trusted
>party (in a different color, if you like).

This only works if DN's in certs are ordered hierarchically.  We rejected
displaying certs ordered by DN almost instantly because the DN's can be more or
less random, or even pseudo-flat (only the CN changes as you go up the chain).
The best attempt was to display them arranged by issuer chaining, but this also
fails when there are multiple effective issuers, the spaghetti of trust is
rather difficult to display graphically (specifically as a tree control rather
than having to draw graphs).

Peter.

---

From: Steve Hanna <[email-masked]>
Date: Thu, 20 Jul 2000 16:29:16 -0400

> than having to draw graphs).

You seem to be trying to arrange certificates into a single order. Perhaps you are trying to display
them in a text format. Certainly, this doesn't work well with a non-hierarchical topology. It isn't
even an accurate depiction of a hierarchy, since the hierarchy must be flattened in some way. But I
don't think the PKIX working group had a design goal of making it easy to display a certificate
network in an ordered text file. Other concerns (like security and business requirements) must come
first. And a *graphical representation* can provide a superior visualization, as my earlier note
indicated.

This is a bit of a tangent from the original discussion and probably not of interest to the list as a
whole. Let's take it off-line. If anyone wants to follow us, let me know.

-Steve