Subject: Re: [sidr] [secdir] [OSPF] [RPSEC] Authentication for OSPFv3

From: Stephen Kent <[email-masked]>
Date: Thu, 2 Oct 2008 12:08:12 -0400

At 11:08 AM -0400 9/30/08, Acee Lindem wrote:
>One thing to take into consideration is that the outcome of our KMART 
>BOF was that nobody deploying networks wanted routing infra-structure
>based on a third-part verified certificates.
>Thanks,
>Acee

Acee,

The wording you used here "third-part[y] verified certificates" is 
ambiguous. A cert is validated (or verified) by a relying party, so 
third-party verification could imply having some entity verify  a 
cert on behalf of a relying party, e.g,  what SCVP permits. If, on 
the other hand, you were referring to cert issuance (not 
verification), then it is commonly the case that the cert issuer 
(certification authority) in a PKI is a "third party" in that it is 
not a participant in a communication between two relying parties.  In 
either case, I don't recall hearing specific comments of the form you 
mention.

Steve
_______________________________________________
sidr mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sidr

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Thu, 2 Oct 2008 21:48:53 -0400

On Tue, 30 Sep 2008 12:05:28 -0400
Sam Hartman <[email-masked]> wrote:

> It's certainly true that some people in the room spoke out against
> certificates.  At least some of the reasons given did not actually
> inherently apply to certificates as a whole although they did create
> some significant constraints for what would not create operational
> problems.
>

Right.  There's a big misconception in the world that using
certificates inherently requires a massive, complex infrastructure
that's best handled by third parties.  In reality, using certificates
within an enterprise need be no more complex than handing out or
accepting passwords.  All you need is a simple wrapper around something
like OpenSSL.  You don't need formal root certificate ceremonies, you
don't need court-certified videographers, you don't need high priests
waving incense and anointing the certificate-signer machine with a
mixture of cow innards and ground-up prime numbers.  (That's what OCSP
is about: Offal of Cow Sprinkled with Primes....)  Whoever hands out
address blocks within the company can sign the certificates -- it's
that simple.  I sometimes refer to this as the difference between "PKI"
and "pki" -- for enterprises, you need the latter.

		--Steve Bellovin, http://www.cs.columbia.edu/~smb
_______________________________________________
sidr mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sidr