Subject: Re: Certificate authentication

From: [email-masked] (Peter Gutmann)
Date: Sun, 18 Jan 2004 22:01:49 +1300

[email-masked] (Niels =?iso-8859-1?q?M=F6ller?=) writes:

>I'd like to do spki certificates, but at the moment it's not a high priority
>either.

Speaking of SPKI, it's not just X.509 that has the issue with being
underspecified, both SPKI and PGP have the same problem.  Instead of removing
these portions entirely, how about adding a note to say that the identifiers
for X.509/SPKI/PGP are reserved for possible future standardisation?  That way
if in the future someone decides they want to get some mechanism standardised,
the identifiers are already defined.

Peter.

---

From: [email-masked] (Niels Möller)
Date: 18 Jan 2004 12:47:30 +0100

[email-masked] (Peter Gutmann) writes:

> for X.509/SPKI/PGP are reserved for possible future standardisation?

Makes sense to me.

As for spki, the only spki-ish I do yet is in the representation of
the "known-hosts" database, where I use acl:s of the form

(acl (entry (subject (public-key (rsa-pkcs1-sha1 (n |AMxUKL4vuu8WvsMpkc/
                                                     bt6ZcdJ7UJxCwaDVOEg
                                                     pd0ZMEhWZK2bEUwtH06
                                                     TimrUDbNa/wSxaFbdta
                                                     FRcCF1XrxkMAfi39Gfu
                                                     cPasFQEDbv2FABRwT06
                                                     gc3uMGCv4ElqkDi6I+6
                                                     zoWZNMbQEulEqnHyncz
                                                     HUVoHrmeedD+oEsxB37
                                                     9|)
                                                 (e "#"))))
            (tag (ssh-hostkey org.gnu.savannah))))

Note the reversed domain name, that is to make it possible to use
acls/certificates with (tag (ssh-hostkey (* prefix org.gnu.))) to
represent the capability of representing any machine under gnu.org.

/Niels