Subject: Re: Global PKI on DNS?

From: "John Stracke" <[email-masked]>
Date: Wed, 12 Jun 2002 16:13:51 -0400

>> I don't want to discount the importance of cert discovery, but I do
>> think it's a stretch to believe that you're going to be willing to
>> trust all of the certs that you discover in a chain of significant
>> length, for a significant set of purposes.
>
>We're already trusting chains of signficant length (i.e. DNS delegation)
>with no decent verification at all.

That's a good point.  PKI on DNS might not be the most trustworthy system 
imaginable, but it would probably be an improvement over no PKI.  Provided 
it doesn't break DNS...

/========================================================\
|John Stracke                    |Principal Engineer     |
[email-masked]   |Incentive Systems, Inc.|
|http://www.incentivesystems.com |My opinions are my own.|
|========================================================|
|E pui muove! -- Galileo                                 |
\========================================================/

---

From: Franck Martin <[email-masked]>
Date: 13 Jun 2002 08:39:37 +0000

I have started this thread... Sorry people, I didn't know I will create
so much passion on these lists... I propose that we meet next week at
INET2002 in Washington to draft something. (www.isoc.org/inet2002/)

I have heard the pros and cons of doing it with DNS and I'm well aware
of them. We could discuss ad eternam of what to do, but I suppose now
the best action is to write a draft informational RFC (informational
only!) that proposes a possible methodology to provide a global PKI with
DNS hooks.

If this document exists then it can be read. examined and submitted to
ICANN/IANA for possible implementation, but that's another story... What
is important is that something exists and then see if people are
willing...

I'm sorry but I won't be at the IETF meeting, unless someone invite me
(pay the trip) but I will be in INET2002 and some of you too... So let's
meet there and discuss. We can get a room in INET for discussion.

If some people agree, then I will put a notice on the board at INET.

Cheers.
[email-masked]

On Wed, 2002-06-12 at 20:13, John Stracke wrote:

---

From: Keith Moore <[email-masked]>
Date: Wed, 12 Jun 2002 17:57:52 -0400

> imaginable, but it would probably be an improvement over no PKI.  Provided

and also provided people don't say "hey, now there's a PKI, so I really can 
trust it!"

Keith