Hi Steve -- Now we are beginning to connect with the real meta issue. I am talking about "Trust Transitivity" in general. We agree that the DNS offers no trust functions, useful or otherwise. So, my focus is not on PKI as related to DNS, which is what you addressed here. It the fundamental issue of trust transitivity in PKI. I will concede that PKI is transitive in terms of "connectedness" as is DNS. Both have relations of relatedness, but this does not confer transitivity on trust. Trust still has to be earned, not awarded, in any case. I am questioning the validity of the widely held assumption that trust is (or can be) transitive in PKI (or anywhere for that matter). So, back to my basic question: Is trust transitive anywhere under any conditions? I question that it is, until someone proves that: "Trust is transitive somewhere/anywhere in real life"; and then prove that: "Trust is transitive in PKI Theory"; and then prove that: "Trust is transitive in PKI reality". HINT: It will help if you can refer to some Formal Logical Theory of TRUST. First, forget PKI and forget DNS, and show that trust is transitive somewhere under some describable conditions. Then show that trust is transitive in PKI. I know that many people assume that Trust is transitive in PKI. I am not asking about popular opinion here. We need some formally logical facts. If you have some, please show them to us. Cheers...\Stef At 1:13 PM -0400 6/14/02, Stephen Kent wrote: >Stef, > >>Thank You Steve for clarifying your simple little error and >>correcting the record on what I did or did not say. I admit that >>the error was small in commission but you must admit that it was >>huge in affect, so it is good for you to corrected the record. >> >>I will assume that it was not intentional. > >no, it was not intentional. > >>Now, all I did was ask you to offer proof that trust is ever >>transitive, as a separate sub-question of the general debate, >>because in my view, this question is central to the reasons for >>bothering to discuss the rest of this thread. >> >>In short, if trust cannot be proved to be transitive, like DNS zone >>control delegation is transitive, then there is no reason to >>continue with PKI designs that ASSUME TRUST IS TRANSITIVE. > > > <snip> > >The essence of our disagreement is that I don't view the >relationship between the CAs in a DNS-based PKI to be one of trust. >We rely on DNS admins to correctly bind addresses to names in the >zones they control. This is the seenace of the semantics of DNS >operation. If these folks acted as CAs, we would rely on them in the >same fashion to bind the same names to public keys, which just >provides a secure mechanism to effect the binding of the name. If >we don't call the first relationship trust, then I don't feel we >should call the second one a trust relationship either. > >You uses the term "delegation" above and that's critical. In a >system like DNS which makes clear who is authoritative for which >names, I don't think the term "trust" is applicable, and that is the >crux of our disagreement. > >Pn a less polite note, your line of argument has been to saddle me >with a need to prove something that I have never asserted, which is >pretty silly, at best. It's not surprising that I continue to >decline to take a side of a debate that you have tried to define for >me and which does not represent my position. > >Steve