Subject: RE: Global PKI on DNS?

From: "John Stracke" <[email-masked]>
Date: Thu, 13 Jun 2002 10:08:49 -0400

>The CERT extension to DNS allows to place there a URI, a URI is smaller 
than
>a cert and stays in a udp packet.

Bootstrap problem: how can you trust the results of the URI?

/=============================================================\
|John Stracke                    |Principal Engineer          |
[email-masked]   |Incentive Systems, Inc.     |
|http://www.incentivesystems.com |My opinions are my own.     |
|=============================================================|
|Q: What goes "Pieces of 7! Pieces of 7!"? A: A parroty error.|
\=============================================================/

---

From: Simon Josefsson <[email-masked]>
Date: Thu, 13 Jun 2002 21:22:56 +0200

> Bootstrap problem: how can you trust the results of the URI?

The URI can contain a hash (fingerprint) of the target data.  C.f. TLS
extensions document.

---

From: Richard Levitte - VMS Whacker <[email-masked]>
Date: Thu, 13 Jun 2002 21:34:14 +0200 (CEST)

In message <[email-masked]> on Thu, 13 Jun 2002 10:08:49 -0400, "John Stracke" <[email-masked]> said:

jstracke> >The CERT extension to DNS allows to place there a URI, a
jstracke> >URI is smaller than a cert and stays in a udp packet.
jstracke>
jstracke> Bootstrap problem: how can you trust the results of the URI?

The same way I trust whatever certificate source I have; not at all.
But from a PKI point of view, that's beside the point, as long as you
can to path discovery and validation all the way between the
certificate I want to verify and a set of root certificates you trust.

So the bootstrap problem is the same regardless of your certificate
source: you need a set of trusted root certificates.

-- 
Richard Levitte   \ Spannvägen 38, II \ [email-masked]
Redakteur@Stacken  \ S-168 35  BROMMA  \ T: +46-8-26 52 47
                    \      SWEDEN       \ or +46-708-26 53 44
Procurator Odiosus Ex Infernis                -- [email-masked]
Member of the OpenSSL development team: http://www.openssl.org/

Unsolicited commercial email is subject to an archival fee of $400.
See <http://www.stacken.kth.se/~levitte/mail/> for more info.