[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Modelling trust
Ed, my apologies for not responding to you. My own e-mail has been badly
misbehaving, with some messages taking two days to get from one of our
servers to another. and last night I was spared the indignity of blasting
out 30 copies of the same message, when my remote e-mail got into some kind of
a loop and transmitted the same message to the server over and over. Fortunately,
the PKIX list server detected the fact that they were dupicates and deleted them.
My suggestion was not related to sin, either original or duplicate -- we've got quite enough
discussion of that topic on this side of the pond, thank you!
Nor was I trying to suggest that the topic was not of considerable interest to many
people, including myself, for I believe that it is.
I was merely being sensitive to my perception that most of the subscribers to this list
are interested in the more prosiac issues of actually building and distributing
certificates, and that if you or someone else had access to another list server that could be
dedicated to the subject of trust modleling more specifically, i would be happy to join it,
and perhaps relieve some of the people who are only concerned with the implementation
details of having to wade through messages that they are not concenred about.
Bob
>>> Ed Gerck <egerck@laser.cps.softex.br> 03/06 11:26 AM >>>
{Cross-posting between cert-talk and spki, as received}
All and everyone ;-)
Due to a catastrophic change in the DNS servers that answer for
*.softex.br (a nationwide domain), now reverted, I was spared by Nature of
some e-mails -- including Bob's, and will present here my rejoinder based
only on what I can infer from Tony's and Chris' msgs below.
I infer that Bob may have thought that my msg "Re: Modelling trust" was
off-topic and I also infer that approximately 10 milliseconds after that
he regreted it (because he did not answer my yesterday's msg to him,
asking for a direct copy of it, after I received Tony/Chris postings).
I think that whenever anyone cries "off-topic!" and a discussion follows
-- that does not involve the original poster -- then it means that it was
NOT off-topic. However, let's be quantitative and objective to evaluate if
such a sin was commited here, based on a simple key-word and context
analysis:
1. My posting was centered on "trust", vis a vis various certification
recommendations and the social/legal understanding of it, citing "X.509"
several times and also quoting an extensive paragraph of "X.509". Further,
the posting commented on the difficulties encountered when using "trust"
in the "X.509" framework, citing the initial "X.509" emphasis on a
subjective view versus the later non-subjective introduction of
"certificate chains" and ad-hoc CA's "CPSs". I also showed that such
trust-based issues decrease the "compatibility of X.509 certificates" to
other named standards (such as PGP or the ABA Guidelines). I further wrote
that such trust issues would eventually invalidate any PKI scheme based on
X.509, because "signing and verification" are not correctly connected, and
practically exemplified it.
2. The cert-talk welcome msg says that the key-words "X.509" and "trust"
belong to the list charter, as well as "Compatibility of certificates
across applications", "Certificate profiles and trust attributes ", "Chain
formation", "Signing and verification".
A simple comparison shows that the key-words listed in (2) are 100% hits
in my msg, as quoted in (1)! Further, the practical examples provided in
my posting also do not allow it to be viewed as academic abstraction --
those are real-world issues and problems.
So, the posting on "Modelling trust" was fully on-topic in cert-talk and
fully targetting "practical technical issues surrounding the use of X.509
certificates in public-key cryptography applications" as cert-talk's
charter says.
Regarding SPKI, which was also CC'd by Tony and Chris, the key-words
contained in (1) have been present in many messages. Further, trust
discussions belong to the heart of things like PolicyMaker or Carl's fight
between trust and authorization. Besides, I know of no other list but SPKI
where one can read and enjoy a nice well-contained discussion on Kurt
Godel's theorems, including the original German text -- without being
bothered by useless "off-topic" cries! A mature list, indeed, where
quietness is like smoldering fire... ;-)
To conclude, very objectively, the posting was certainly not off-topic.
Further, if one accepts the fact that the main problem in certification
today is NOT cryptography, but trust -- then the posting is part of a
future trend, in which cert-talk list members may need more and more to
discuss, define and decide: What is trust? How is trust created? How is
trust transferred? Yes, because such answers are NOT provided in X.509 --
even though they are needed for X.509 practical use.
Bob missed the mark, maybe by 10 milliseconds....
(then, was *his* posting off-topic?)
May I end this posting reminding the audience about Mark Twain's cat...
so, let's take the lesson and forget the pain ;-)
Bob: the beer is on you...
Cheers,
Ed
On Thu, 5 Mar 1998, Tony Bartoletti wrote:
>Chris,
>
>I know that each of the lists PKIX, SPKI and "cert-talk" tend to have
>little patience with academic discussions on modeling. If you find a
>list that is more appropriate, let me know and I will sign up as well.
>
>The PKIX list is focused upon working out the details of X.509v3.
>
>"cert-talk" (perhaps inappropriately named) is focused upon practical
>how-to questions over existing deployed implementations.
>
>SPKI (rather quiet of late) has already transitioned from theory to
>implementation, but they may be the most receptive. I say this because
>the lightweight (some would say "inadequate") nature of their form for
>supporting global PKI still leaves as an open question how this form
>might be deployed and "ganged together" to support larger and varied
>needs. (I hope Carl Ellison and Perry Metzger don't beat me up;)
>
>Maybe Ed Gerck has some suggestions;)
>
>
>At 11:43 AM 3/5/98 -0600, you wrote:
>>
>>In response to the appropriateness of discussing trust models in this
>list, I
>>would assume that many of the participants on this list would be
>interested in
>>the underlying application and usefulness of the trust model that public key
>>technology enables. For us to blindly discuss the detailed technical
>specifics
>>of any given technology without keeping our feet grounded in the
>"real-world"
>>drivers sustaining the development of that technology would be
>irresponsible, to
>>say the least.
>>
>>Given that, I would be very happy to participate in another list if my
>>colleauges in this forum are not as receptive to these types of
>discussions as I
>>am.
>>
>>Chris
>>
>>-- see attachments --
>>---------------------------- Forwarded with Changes
>---------------------------
>>From: BJUENEMAN@novell.comords at Internet-USA
>>Date: 3/4/98 2:09PM -0800
>>*To: egerck@laser.cps.softex.br at Internet-USA
>>*To: cert-talk@structuredarts.com at Internet-USA
>>Subject: Re: Modelling trust
>>---------------------------------------------------------------------------
>----
>>
>
>Tony Bartoletti LL
>SPI-NET GURU LL LL
>Computer Security Technology Center LL LL LL
>Lawrence Livermore National Lab LL LL LL
>PO Box 808, L - 303 LL LL LLLLLLLL
>Livermore, CA 94551-9900 LL LLLLLLLL
>email: azb@llnl.gov phone: 510-422-3881 LLLLLLLL
>
______________________________________________________________________
Dr.rer.nat. E. Gerck egerck@novaware.cps.softex.br
http://novaware.cps.softex.br
--- Meta-Certificate Group member, http://www.mcg.org.br ---
+--------------------------------------------------------------------------+
+ For information about the cert-talk mailing list, including archives +
+ and how to subscribe and unsubscribe, visit: +
+ http://mail.structuredarts.com/cert-talk +
+--------------------------------------------------------------------------+