[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: comments on client auth
Date: Wed, 19 Jun 1996 18:10:24 -0500 (CDT)
From: "Brian M. Thomas" <bt0008@entropy.sbc.com>
>> (3) verification of the uniqueness of keying material shall be guaranteed
>> during each naming attestation by each and every principal in the domain
>
> Perhaps you could explain why this should be so.
It would be unfortunate if two totally unrelated users shared, by
chance, the same keying material. It would be more unfortunate if one
or the other of them discovered this fact.
A heirarchical certificate creation mechanism can ensure that keying
material is not duplicated anywhere within the heirarchy; an
uncoordinated mechanism can make only probabilistic "guarantees".
This may be good enough for the commercial "insurance" business model,
but it doesn't give me warm fuzzies.
This is not really related to naming, except that "naming attestation"
as used above appears to be a fancy term for creating a certificate -
generating a keypair and assigning a name. The generation of key is
what counts, the name is irrelevant.