Subject: Re: ASN.1 vs XML (used to be RE: I-DACTION:draft-ietf-pkix-scvp-00.txt)

From: "Aram Perez" <[email-masked]>
Date: Wed, 14 Jul 1999 08:56:46 -0700

Steve Kent wrote:

> I think it is a rare user indeed who ever wants to look at a certificate.
> Experience suggests that the certificate viewing feature of browsers is
> rarely invoked by the average user.

That's because the average user (and I'm afraid a lot of people who claim to
understand public key cryptography/PKI) don't realize the need/requirement
to verify root certificates with an out-of-band mechanism.

Aram Perez

---

From: Daniel Finkelstein <[email-masked]>
Date: Wed, 14 Jul 1999 12:11:16 -0400

Aram Perez wrote:

> rarely invoked by the average user.

That's because the average user (and I'm afraid a lot of people who
claim to

Aram Perez

And these can get more complicated as operations differ. Such a verification
mechanism as provided by Netscape's security window only does so much;
presumably more when it retrieves certificates from directory servers.
To quote from the EntrustFile Toolkit documentation:

It is often asked why a user needs to log in just to verify
a digital signature. In order to verify a digital signature, it is first
necessary to prove that the sent verification public key certificate is
valid. The latter task requires the retrieval of a trusted copy of the
CA's verification certificate from the user's password-protected profile.
To open the user profile, the user needs to identify the profile and supply
the password for it -- in other words, the user needs to log in.

--
Daniel Alex Finkelstein
New Technologies
phone   212-383-2951
pager   917-427-1630
fax     212-383-3289
Securities Industry Automation Corporation