Keyservers and Spam

[Anne & Lynn Wheeler]

At 11:56 AM 6/13/2003 -0400, John Kelsey wrote:
>The thing that strikes me is that the PGP web of trust idea is appropriate 
>for very close-knit communities, where reputations matter and people 
>mostly know one another.  A key signed by Carl Ellison or Jon Callas 
>actually means something to me, because I know those people.  But 
>transitive trust is just always a slippery and unsatisfactory sort of 
>thing--the fact that Jon Callas trusts Fred Smith trusts John Jones to 
>sign a key doesn' t really tell me whether or not I should trust him--by 
>the time we're about three hops away, you'd have to be God to know enough 
>to have your signature mean anything.

PGP .... or other similar account-based mechanisms provide trust between 
parties that have established relationship .... on a purely pair-wise, 
bilaterial basis.  It does allow some direct trust operations to diffuse 
out to other parties. It isn't so much a close-knit community .... it is 
how far every specific entities's trust operation diffuse out across other 
individuals.

If the entity is called a certification authority .... and it provides an 
online service ... then the diffusing of specific trust operation might 
propogate out to a wide community. The issue of course is what trust 
attributes are propagating/diffusing and the diligence that the entity used 
in establishing the information to be trusted.

If the entity is called a certification authority, and it manufactures 
certificates (basically stale, static copies of some CA internal account 
record) then those certificates will presumably contains some information 
that is bound to the public key ... where there is some degree of 
confidence (aka trust) with regard to the binding between the information 
and the public key.

One issue is what meaning is there between having absolute certainty 
between something like an email address and a public key. Let's say it is 
an email address. Typically, email addresses at random are meaningless to 
me unless they are part of some specific context .... like somebody I have 
an established relationship with. However, if I have an established 
relationship with the entity, then it is back to the PGP scenario.  In a 
broad context, businesses run on established relationships; aka financial 
institutions.  The whole existing payment infrastructure effectively has 
the PGP scenario without needing certificates, and not exactly being 
considered a very close-knit community.

The primary difference between a financial institution actiing as an entity 
in a PGP web-of-trust paradigm (say payment cards, credit, debit, etc) and 
individual .... is the typical scope of the reputation of the financial 
institution is larger than an individual, and therefor the 
propagation/diffusing of trust is likely to have a much further reach. To a 
larger degree ... the trust radius of an entity is somewhat independent of 
whether it is operating in the PGP manner w/o certificates or in 
certificate paradigm.

The primary difference in the certificate paradigm is not the scope of the 
entity's trust .... it is the design point of delivering the trust. The 
certificate paradigm of trust delivery was targeted at an offline 
environment for relying parties that had no previous relationship (and had 
no online and/or direct recourse to the trust entity.

The payment card industry established a certificateless nearly world-wide 
scope of trust, in part by providing an extensive online network.

The certificate-based design point was to be able to provide an 
infrastructure for propogating trust between relying parties that had no 
previous relationship, were unlikely to need future relationship, and had 
no online or direct recourse to the trust enttity.
--
Anne & Lynn Wheeler    http://www.garlic.com/~lynn/
Internet trivia 20th anv http://www.garlic.com/~lynn/rfcietff.htm
  


---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com