[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: non-key-sharing
>
>
>I get the feeling that there is an underling assumption that key pairs are
>a scarce resource. This is certainly not true in the SPKI case, although
>it may be in the more general digital signature realm. In the banking
>case, I specifically mentioned the assumption that the key pair used was
>specific to the account.
>
>If key pairs are to be considered scarce, what technical and social steps
>must we take to make them scarce? If they are not scarce, then people who
>want to "informally delegate" them have no incentive not to share them. A
>modest charge for a cert will only be a modest disincentive.
>
I don't think that the keys themsleves are scarce. Rather, it is that
certificates are expensive, because of the administrative burden and
liability implications of binding of the key to anything at all, whether an
"identity" or a set of capabilities. (I'm using the term certificate in the
most generic sense, not tied to X.509 or any other format.)
You can certainly make certificates inexpensive, but only by making them
essentially worthless to the relying party.
Bob
Robert R. Jueneman
Security Architect
Novell, Inc.
Network Services Division
122 East 1700 South
Provo, UT 84604
801/861-7387
bjueneman@novell.com
"If you are tring to get to the moon, climbing a tree,
although a step in the right direction, will not prove
to be very helpful."
"The most dangerous strategy is to cross the chasm in two leaps."
Follow-Ups: