Subject: [p2p-sip] Authorities and signing, based on comments on concepts-02

From: slavitch at gmail.com (Michael Slavitch)
Date: Wed, 18 Oct 2006 12:08:52 -0400

Some questions on making self-signing acceptable to security AD's:

1.  Is self-signing better if the identity that is self-signing for
the network persistent and assured?    Would it be considered better?
For example,  Phil Zimmerman's  zRTP is somewhat useful for creating
RTP sessions but the concept is far more useful in day to day life for
creating persistent trust of identity.

2. If the identity of the signer is trusted by the P2P universe (and
the identity mechanism is trustworty) isn't this as good as a CA for
the context at hand?  And given how many people properly maintain
their issued certs isn't in fact better?

3. Who decides trust? Does trust >need< an external CA authority?  Is
this a requirement of the security AD's?

4.  If self-signing could only be done by entities having 'perceived
trust' does this mean that the "Central Authority" is now a role that
could be distributed or shared?

5. Essentially, what does "Central Authority" mean in a world of peers?