Subject: RE: Infinite loop: See loop, infinite

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 25 Jan 2002 07:49:51 -0800

> (This is even more amusing than the wonderful 
> Windows-produced certs with URLs
>  like "file://\\bobs_win2K_box\blah.cer", which are going to 
> be really useful
>  to the world at large).

Come now, limiting the ability to make use of a certificate to
a specific domain is something a lot of people have been asking
for.

There have been many exotic schemes that are a lot less reliable.
Kinda like the various cryptographic exotica to provide someone's
definition of anonymity which can often be addressed at far lower
cost using something like a one time use certificate.

		Phill

---

From: [email-masked] (Peter Gutmann)
Date: Sat, 26 Jan 2002 05:42:04 +1300 (NZDT)

"Hallam-Baker, Phillip" <[email-masked]> writes:
>>(This is even more amusing than the wonderful Windows-produced certs with URLs
>> like "file://\\bobs_win2K_box\blah.cer", which are going to be really useful
>> to the world at large).
>
>Come now, limiting the ability to make use of a certificate to a specific
>domain is something a lot of people have been asking for.

But the point was that these aren't being deployed in a limited domain, they're
appearing in things like S/MIME signatures.  Putting a field which can only be
used on a local network in a cert which is distributed worldwide seems somewhat
counterproductive (although cAKeyCertIndexPair, which only makes sense to the
specific machine which created the cert, is even sillier).

Peter.

---

From: Peter Williams <[email-masked]>
Date: Fri, 25 Jan 2002 13:48:18 -0800

http://www.ubiqx.org/cifs/index.html

Once the SMB URL form gets to RFC, the file:// should
probably change to smb://

On an MS platform, the platform which was
the target of the jibe, file: is logically
the same as smb: anyway.

if the win2k or even better the .net CA server
from Microsoft put smb://<ip-address>/foo.cer then
(a) we will get the SMB/NMB browsing and
browser elections, to enable cert repository discovery 
and location for free, with auto determination 
of which is the most reliable repository mirror
(b) end-end authentication of each SMB message without
needing IPSEC support for the validation protocols
built over SMB
(c) the ip-address means we overcome the naming
scoping limitations of netbios, but we still dont
need to rely on global DNS or VeriSign control of name
registration, etc. IP addresses are names
in their own right, remember, and are routable using
source-IP controls, and IP forwarding nets.
(d) on actual windows client platforms worldwide, users can 
bind in parallel to multiple repositories with different credentials, 
when the repository is located using IP address name
rather than a netbios name.

I think they are going in the right direction: potentially,
using net mechanisms to assist with discovery and location
of PKI objects. Its a well proven technology... for
peer-peer networking of private domains, security,
certification, or otherwise.

Peter.

-----Original Message-----
From: Hallam-Baker, Phillip
To: [email-masked]; [email-masked]
Sent: 1/25/02 7:49 AM
Subject: RE: Infinite loop: See loop, infinite

		Phill

 <<Phillip Hallam-Baker (E-mail).vcf>>