-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
| All of those statements, assertions, and so on can be made in simple | signed messages. When you get a message with statements about your job, | you verify that the message has been signed using your boss' public key. | What's the problem here? | | --Paul Hoffman, Director | --Internet Mail Consortium |
There are several subtle problems in practice (or at least in my admittedly limited experience). The major problem is that pki's tend to have high life-cycle costs mainly due to the lack of widely deployed management protocols. Compare the cost per user of operating a pki and a kerberos realm for instance.
This leads deployers to opt out of using the various extensions which could be used to decide weather a given certificate chain is ok to use with application X. "We can't afford to re-issue certificates whenever a new application is introduced...". The large-scale PKIs I have seen (again - I expect to be refuted on this point) are only used as identification mechanisms and identification is, as Keith points out an easy problem compared to the policy decisions which have to be made *by the client* in order to establish trust for a given application.
MVH leifj -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQE/3N3P8Jx8FtbMZncRAp0IAJsEV3aWYdYI+x5jxHVJDixDWh6pwQCcCeJH ZTeAyJlO8eqX+uzCApbNw9c= =xL45 -----END PGP SIGNATURE-----