Subject: RE: Trust and client choices

From: Zahid Ahmed <[email-masked]>
Date: Tue, 14 Sep 1999 14:49:52 -0700

The attached book's review at amazaon.com claims that the
book contains the public keys of many CA's root certificate.

I think this is nice; but, where is the web sites and/or
publicly accessible LDAP server that is publishing all
(or most of the generally used) CA's public certificates
such that servers can register trusted CAs. E.g., are
the CA service providers (e.g., Verisign, Entrust,
GE, Wells Fargo, other european CAs,) publishing their
CA pubic root certificates at their web sites?

If not, why not?

thanks,
Zahid

> Zahid Ahmed wrote:
> > 
> > to trust CAs, the server needs to be aware of the
> > CA's public root certificate.
> > 
> > do you know where such root certificate are published?
> > e.g., for verisign, entrust, thwarte, etc.
> > 
> > is there a global CA root certificate directory/web server?
> 
> "The Global Internet Trust Register", pub. MIT press?
> 
> Cheers,
> 
> Ben.
> 
> --

---

From: "Bob Jueneman" <[email-masked]>
Date: Tue, 14 Sep 1999 18:05:39 -0600

The intent of the book is to provide some reasonable 
out-of-band way of verifying the top level CA's certificates.
If you think about it, publishing a CA's certificate in their 
own web site is rather circular logic.  How would you know
that it is really them?

On the other hand, the book publishers (at the time we 
talked to them) had reasonable levels of assurance in their
procedural mechanisms, but weren't willing to put their money 
where their mouth with any real amount of liability.

(I don't blame, them, however.  You'd have to sell a lot
of books to cover that much liability.)

So the major CAs provide their top level roots directly 
to the major vendors to incorporate in their software.

IMPORTANT POINT:  If you don't trust the vendor of your
relying party software, all of the trust that you have in all of PKI
goes straight out the window!

All I have to do as the vendor is simply answer "trusted" to 
any question you ask, and you are hosed.

Bob (Trust me -- have I ever lied to you before?  Well, recently?) Jueneman

>>> Zahid Ahmed <[email-masked]> 09/14/99 03:49PM >>>

If not, why not?

thanks,
Zahid

---

From: Dennis Nwaigbo <[email-masked]>
Date: Wed, 15 Sep 1999 06:49:00 -0700 (PDT)

Where is the book in question?

cheers,

--- Bob Jueneman <[email-masked]> wrote:
> +-------------------------------------------------------------+
> + For information about the cert-talk mailing list,
> including +
> + archives and how to subscribe and unsubscribe,
> visit:       +
> +          http://www.structuredarts.com/cert-talk  
>          +
> +-------------------------------------------------------------+
> 

===
DENNIS NWAIGBO (w-e-e-b-o)
Network Security Engineer
Bank of America Corporation
Work: 214.508.6594
Home: 972.986.5107
__________________________________________________
Do You Yahoo!?
Bid and sell for free at http://auctions.yahoo.com