[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: The case against mega-certificates
At 02:34 PM 5/8/96 -0400, hallam@vesuvius.ai.mit.edu wrote:
>
>Hi,
>
> Just to try to bring out what I believe is the most important
>part of SDSI - all users are logical peers and have equal rights to
>define security policies. No more of the old VMS problem of having to
>have OPER (system privilege) to create a rights identifier.
Yup -- that's one of its beauties.
> Whether you bind everything together into a single entity or
>not should not depend on whether you are using CD-ROM or the net. One
>can always use a file: or relative url to access a disk resource.
>
> This might well be an opportunity to employ a naming scheme like
>WEB://ai.mit.edu/document or PDIs. Provide data on the disk, an provide some
>sort of index to permit users to use the disk as a frozen cache for object
which
>may have been updated on the network.
I'm not sure I followed you in those paragraphs.
To me, the pointer/inclusion debate is one of performance. As long as we
have secure references that can stand for various (bulky) fields, then we
can be selective about transferral and hashing of those fields. For
example, a watchman's desk computer could have GIFs already cached for the
frequent visitors and not have to go through that again. -- or someone using
the cert for other purposes could just ignore that field and have paid
little to fetch or store it.
Of course, my preference (in accordance with generalized certs) is to have a
separate cert for binding a picture to a key and provide that cert only if
the need arises.
- Carl
+--------------------------------------------------------------------------+
|Carl M. Ellison cme@cybercash.com http://www.clark.net/pub/cme |
|CyberCash, Inc. http://www.cybercash.com/ |
|207 Grindall Street PGP 2.6.2: 61E2DE7FCB9D7984E9C8048BA63221A2 |
|Baltimore MD 21230-4103 T:(410) 727-4288 F:(410)727-4293 |
+--------------------------------------------------------------------------+
Follow-Ups: