Subject: RE: Dual-signed certificates

From: Simon Tardell <[email-masked]>
Date: Mon, 24 Jul 2000 10:06:22 +0200

> Eh? What does this have to do with web-of-trust? This is to do with
> contracts (i.e. the one between the subject and the issuer).

It is? If there is a contract involved, the certificate is only half of it,
the other half being your certificate request. Is a driver's license a
contract? Does it put me under any obligations simply having one? Or does
using it put me under obligations?

> I do find it strange that there seems to be this kind of knee-jerk
> reaction that says "if it isn't a CA signing, then it must be
> web-of-trust, and that's bad".

No, I believe there are perfectly valid domains for web-of-trust. 

> Anyway, the point you are making appears to reinforce my point, not
> argue against it: no-one can work out whether a CA is honest, but the
> subject signs the cert, they can at least work out that _the subject_
> trusts them (within the context of the issued cert, of course)!

The parenthesis is my problem with this. You have to anchor your trust
somewhere, either in the CA, or in the subject. And if you already trust the
subject public key, what use is the cert in the first place (especially
since you don't derive any further trust from it)? 

But I think there is a much simpler answer to this. If I don't agree to what
the CA wrote into my cert, I don't use that cert (if you don't agree to the
name that goes with the picture in your driver's license, don't drive on
that license).

Cheers,

Simon

Simon Tardell, Software Architect, iD2 Technologies
voice +46 8 7755225, fax +46 8 7267912, cell +46 70 3198319
[email-masked], http://www.iD2tech.com
Securing the Internet economy

---

From: Ben Laurie <[email-masked]>
Date: Mon, 24 Jul 2000 10:37:18 +0100

Simon Tardell wrote:
> the other half being your certificate request.

Perhaps so, but I don't see how this either invalidates my point or has
anything to do with web-of-trust.

> Is a driver's license a

This seems like a red herring to me, but perhaps I'm missing something.

> since you don't derive any further trust from it)?

A certificate is more than a simple wrapper for a public key - it binds
the key to a set of attributes. The fact that I trust the key does not
allow me to know that, for example, the issuer has authorised them to
perform some actions, but the cert does.

> name that goes with the picture in your driver's license, don't drive on

That would mean that any signature would also have to include (a
reference to) the cert(s) that are agreed to by the signer, which would
be another way to approach the matter, but doesn't just drop out of
existing standards.

Cheers,

Ben.

--
http://www.apache-ssl.org/ben.html

Coming to ApacheCon Europe 2000? http://apachecon.com/