replacing preshared keys

[Bill Sommerfeld <sommerfeld@east.sun.com>]

> A LOT longer.  Long enough that -- unlike preshared keys -- you cannot
> enter them manually.

how about either hash-of-public-key (i.e., key fingerprint) or
hash-of-selfsigned-cert or as the user-visible identification blob?

with truncated hashes, you can trade off security vs. ease-of-use.

> True.  But PK, even if all you ever use is selfsigned certs, still
> needs a lot more near-incomprehensible concepts than preshared keys
> do.

user runs a program to generate the node key and the self-signed cert
and it spits out the hash-of-key or hash-of-cert which is exchanged
out of band with peers.  i don't see particularly hard concepts there
in terms of explaining what you have to do..

						- Bill