Subject: RE: Trust and client choices

From: Zahid Ahmed <[email-masked]>
Date: Tue, 14 Sep 1999 17:58:02 -0700

That is true; the whole CA model is based on a root
level trust hierarchy. Compromising the set of trusted
CA compromises the security at that site.

However, w/o a global, perhaps even centralized, registry of 
CA Servers, the only way we can implement distributed PKI
security is by some out-of-band, most likely business
("trust") relationship with the CA vendor. Obviously such
a registry should have a certain level of security to protect
its data and a trusted server (e.g., via SSL/LDAP).

I think we have gone thru this discussion before w.r.t. a DNS like
model for registering CAs, but I don't see any standard
specification related with it enabling registering/publishing 
CA identities. 

that seems to be fine for some web servers and browser
vendors, but for many other PKI clients and servers
this technical and business model is limiting. 

> -----Original Message-----
> From: Bob Jueneman [mailto:[email-masked]]
> Sent: Tuesday, September 14, 1999 5:06 PM
> To: Zahid Ahmed; [email-masked]
> Cc: [email-masked]
> Subject: RE: Trust and client choices
> 
> 
> The intent of the book is to provide some reasonable 
> out-of-band way of verifying the top level CA's certificates.
> If you think about it, publishing a CA's certificate in their 
> own web site is rather circular logic.  How would you know
> that it is really them?
> 
> On the other hand, the book publishers (at the time we 
> talked to them) had reasonable levels of assurance in their
> procedural mechanisms, but weren't willing to put their money 
> where their mouth with any real amount of liability.
> 
> (I don't blame, them, however.  You'd have to sell a lot
> of books to cover that much liability.)
> 
> So the major CAs provide their top level roots directly 
> to the major vendors to incorporate in their software.
> 
> IMPORTANT POINT:  If you don't trust the vendor of your
> relying party software, all of the trust that you have in all of PKI
> goes straight out the window!
> 
> All I have to do as the vendor is simply answer "trusted" to 
> any question you ask, and you are hosed.
> 
> Bob (Trust me -- have I ever lied to you before?  Well, recently?)
> Jueneman
> 
> 
> 
> >>> Zahid Ahmed <[email-masked]> 09/14/99 03:49PM >>>
> 
> 
> The attached book's review at amazaon.com claims that the
> book contains the public keys of many CA's root certificate.
> 
> I think this is nice; but, where is the web sites and/or
> publicly accessible LDAP server that is publishing all
> (or most of the generally used) CA's public certificates
> such that servers can register trusted CAs. E.g., are
> the CA service providers (e.g., Verisign, Entrust,
> GE, Wells Fargo, other european CAs,) publishing their
> CA pubic root certificates at their web sites?
> 
> If not, why not?
> 
> 
> thanks,
> Zahid
> 
> 
> > Zahid Ahmed wrote:
> > > 
> > > to trust CAs, the server needs to be aware of the
> > > CA's public root certificate.
> > > 
> > > do you know where such root certificate are published?
> > > e.g., for verisign, entrust, thwarte, etc.
> > > 
> > > is there a global CA root certificate directory/web server?
> > 
> > "The Global Internet Trust Register", pub. MIT press?
> > 
> > Cheers,
> > 
> > Ben.
> > 
> > --
>

---

From: Stephen Kent <[email-masked]>
Date: Wed, 15 Sep 1999 16:25:24 -0400

>this technical and business model is limiting.

Your characterization of "the whole CA model" is unduly narrow, perhaps
influenced too much by the specific choices made in the browsers.  I
suggest you review some of the literature on CA models that do not rely on
global CA registries.

Steve