Subject: RE: X.500, LDAP Considered harmful Was: OCSP/LDAP

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 27 Jan 2003 07:44:20 -0800

> One could imagine other forms of using dc-style LDAP DNs and 
> SRV RRs, e.g. 
> look at the domain part of an e-mail address and query the 
> SRV RR for it.

As the group knows I suggested that what, four years ago. The
problem is the following lookup

> Retrieve e.g. encryption cert for [email-masked]:
> 
> ldap://mydirectory.stroeder.com/dc=stroeder,dc=com?userCertifi
> cate?sub?(mail=[email-masked])
> -> certificate

This is only going to work if the LDAP DIT is configured to support
this query. No companies do this for their central directories

What this means is proposing LDAP as the certificate repository 
is doomed to fail since we are not proposing a use of LDAP that
is compatible with the LDAP enterprises have already deployed
we are proposing either a second LDAP to be bound to the first
with some sort of duct tape (perl, awk whatever) or we are 
proposing root canal treatment on some CIO's directory...

This is the equivalent of the 'i'm not hungry, ill just have
some of yours diet'. We pretend that PKI does not need a 
repository, then we go in and insist that existing systems
be reengineered to meet PKI need badly.

I don't want to discuss the technical argument of 'could'
however, I have seen where that has got us. 

> > I'm imagining it would be possible to have a network of 
> interconnected
> > LDAP servers through referals, kind of the way DNS servers are
> > interconnected today, with the only difference that the 
> "zones" would
> > be trees in the DN namespace.

That is not going to happen. But the reason we are being
force fed directories is that the people who tried to 
make it happen have still not given up.

They have got their fangs into PKI because they believe
that we are their killer application.

> Requires a naming authority for X.521 names though.

> > With such a network, one would need to know a few LDAP 
> roots, and the
> > rest is about walking until there are no more answers or 
> until one has
> > found what one was looking for...
> 
> Well, that was the basic idea of X.500...

Which has failled utterly. 

		Phill

---

From: Michael Ströder <[email-masked]>
Date: Mon, 27 Jan 2003 17:29:00 +0100

> that we are their killer application.

Uuh, anyone here still believe that PKI is a killer application?

Ciao, Michael.

---

From: "Anders Rundgren" <[email-masked]>
Date: Mon, 27 Jan 2003 18:27:44 +0100

>Uuh, anyone here still believe that PKI is a killer application?

I believe PKI as a "killer application" has made a lot of people think
that PKI in some way stands above information systems.  This has
lead to very flawed uses of PKI, essentially only suitable for sending
signed and encryption mail between individuals.

When PKI finally is "degraded" to securing communication
in and between information systems, PKI will be a
"killer technology" at least.

For that to happen with must get rid of employee certificates which
is a monstrosity from an information-management point of view.
How much is that company badge of yours worth outside of
the company walls?  Rather little I assume.  But how come it
ever got "PKI-fied"?

Anders R

---

From: "Blake Ramsdell" <[email-masked]>
Date: Mon, 27 Jan 2003 12:57:20 -0800

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Michael Ströder
> Sent: Monday, January 27, 2003 8:29 AM
> To: Hallam-Baker, Phillip
> Cc: [email-masked]
> Subject: Re: X.500, LDAP Considered harmful Was: OCSP/LDAP
> 

Isn't this year the "year of PKI"?  It has been for the last five or
six, I seem to remember ;).

Blake