[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Out on a loop
> From: Nick Szabo <szabo@best.com>
>
> Actually, X.509 should stop calling itself a "Public Key Infrastructure"
> as well. The term implies that the X.509 methodology does or should cover
> all, or at least the most important, uses of public keys.
It implies nothing of the sort. I don't have a dictionary handy, but I
think most people would agree that "infrastructure" means something
built and used by society at large - roads, power distribution systems,
the regulatory system upon which banks are based, the Internet
backbone, etc.
Whereas a protocol is something that may or may not be standardized in
form by society at large, but is generally instantiated and used among
peers.
It's ridiculous to assert, as you seem to, that infrastructure means
"that which is important", and everything else is "that which is
unimportant". I didn't imply, and certainly don't agree with,
your definition.
If we can't agree on a common lexicon, then we don't have much to talk
about. But if you accept my definition, then "infrastructure" implies
concepts like methods of identifying entities which can be useful for
purposes like commerce between unrelated parties without requiring
supplementary community agreements - i.e. global names.
Thus X.509, which allows but does not require global names like
"C=US, O=ConglomoBank Inc., Acct=123456", enables the creation of an
infrastructure. Schemes that are designed exclusively around local
names such as an unadorned "Acct=123456" are more suited to uses
limited to the community within which such names are meaningful.
Names are not the only distinguishing feature between systems suited
for large-scale use and those suited for local use, but they are the
most visible. It is possible to use a global mechanism locally, such
as within a company intranet. If the global mechanism is designed for
flexibility in allowing unneeded features to be ignored, it is not only
possible but efficient.
But it is difficult, if not impossible, to use a system designed for
local use to support global purposes. You wind up hacking on
appendages, such as Kerberos "realms", to deal, imperfectly, with
issues which only arise when operating outside the local context.
If you start with a small definition of local and try to expand it
to cover the earth, you run into the same issues.
If you have better words than "infrastructure" and "protocol" to
distinguish between the two different purposes, then please suggest
them. But don't try to claim that spki and pkix are equally suited to
the task of building what is commonly known to the public as an
"infrastructure".