[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Validity periods can be handled more explicitly
> haven't addressed non-cert signed bodies yet. Do we need to?
Suppose we had a general system for expressing assertions and requests
and a way of signing a canonical form thereof. In my ideal "simple"
public key infrastructure you don't need anything else. A certificate
is just a particular case: an assertion involving public keys.
There are two very distinct potential applications of public keys.
In the first the holder of the matching private key has a clear
wish to protect the private key in his/her own interest. For example
if you have a bank account that can be manipulated by signed requests
to the bank then you will look after that private key. And the bank
probably doesn't care whether you do or not.
In the 2nd type of application the holder of the private key may be
able to gain an advantage by allowing others to use it. For example
in Australia you need to prove that you are over 18 to purchase
alcohol. Consider an electronic order (signed request) for alcohol.
It is worth considering what set of signed assertions need to accompany
that request for the seller to be able to claim in court that he
took reasonable steps to ascertain that the purchaser was over 18.
[Or more realistically: if designing a system which will allow the
purchase of alcohol over the Internet what sort of certification
processes need to be instituted.]
I don't think SPKI needs to cut itself off from the second sort of
application.
Bob Smart
Follow-Ups:
References: