Re: What ASN.1 got right

[Phillip Hallam-Baker <phill@xxxxxxxxxxxxxxx>]

On Tue, Mar 2, 2021 at 7:20 PM Christian Huitema <huitema@xxxxxxxxxxx> wrote:

On 3/2/2021 4:00 PM, George Michaelson wrote:

> X.500 is complicated because names are complicated.

Well, no. George, I worked on X.500 at the same time you did, and my
conclusions are different. X.500 names main source of gratuitous
complexity what that they embedded an arbitrary hierarchy. If I remember
correctly, the name hierarchy in X.500 embedded things like country
name, telecom company name, city, street, company (aka, organization),
department (a.k.a., organization unit), maybe several levels of those,
and then common name.

X.500 was designed to support X.400 email which was designed to replace mail. So of course you would write out the postal address to send an email. Email is mail right? Skendomorphism rulz.

DNS also suffers from gratuitous hierarchy but it is only one layer of bogosity most of the time. There was never any logic to .com/.net/.edu it was a naive taxonomy which has only worked for extracting rents. It worked because it was only four redundant characters.

Names are simple, it is when people try to encode unnecessary assumptions into them that it all collapses. 

On Tue, Mar 2, 2021 at 6:23 PM Michael Thomas <mike@xxxxxxxx> wrote:

On 3/2/21 2:27 PM, Phillip Hallam-Baker wrote:

So I just looked up ssh certificates which I think somebody mentioned. This is a prime example of throwing needless complexity at a problem. If you just added the user's public keys to, say, an LDAP repo, you get the scaling they claim to be solving for, and avoid all of the needless complexity of issuing certs and installing them on the client. The client ssh doesn't need to do anything different as bonus. With LDAP you get the added bonus that it can dish out attributes for things like roles and permissions, which would be a giant headache if it had to be done with reissued certs every time your role or permission changed.

I'm trying to think of major things that use public key authentication. There's TLS with certs, DKIM using raw public keys, and SSH mainly using raw public keys. Am I missing anything else that is widely deployed? DNSsec and BGP are still pretty skimpy from what I can tell.

Or you could use XKMS which is a W3C spec that does exactly that.

The peculiar thing about SSH certs is that they only exist for servers, not for users. At least as far as I could see.