At 2:39 PM -0400 6/17/02, Keith Moore wrote: > > Well, we agree on the utility of having multiple PKIs. We disagree on >> the need for a PKI that happens to cover a specific name space that >> underlies the vast majority of IP-based communications, or at least >> you disagree on the desirability of that specific PKI given the >> reality of who runs which TLDs. But, you don't offer any suggestions >> on how to address the need that a DNS-based PKI satisfies. > >I don't see it as a 'need' in that sense. If you want to increase >the level of trust over the current situation, you pretty much have >to either exchange keying material directly with that party, >or pick a third party that *you* trust to serve as an intermediary. >It's really hard to have multiple intermediaries because you need >to trust them all. And just because someone runs a TLD doesn't mean >that you want to trust them - it often means you should be wary of them. direct exchange obviously does not scale well, and picking a third party gets into the trust problem all over again, as well as requiring that BOTH you and the other correspondent trust. >It really doesn't have much to do with DNS - the problem is that >real trust doesn't scale to that level no matter what the naming >scheme or the protocol. Your later message clarified this, i.e., you believe that in general one cannot identify a third party who enough people trust to act as a CA for a large set of people. I argue that we are have learned to accept organizational entities as authoritative issuers of credentials all the time and that this is no different. This is not a suggestion to have only ONE PKI for everything. It is a suggestion to have exactly one for the purpose of securely binding DNS names to keys. If you are afraid that people would come to rely on this one too much, and that it would deter other PKIs from being formed, maybe that's an indication that it would be more valuable that you care to admit :-) Steve