Subject: Re: Qualified Certificates draft - Country name

From: "David P. Kemp" <[email-masked]>
Date: Thu, 4 Mar 1999 10:42:59 -0500 (EST)

> From: [email-masked] (Arnoud "Galactus" Engelfriet)
> 
> The number of .com domains is now well over 3 million. It's hardly
> a meaningful top-level domain anymore.

Au contraire.  What is meaningful about it is that those 3 million
domains are registered in a single place, and as a result a given
name can be resolved unambiguously.

The longer I look at naming heirarchies, the more my goodness metric
becomes "the flatter, the better".  It would be fine with me if
certificates were indexed by hash value (as stored in AKI), and
one could find every certificate on the Internet by looking it up
in The Directory by that value.

Bob, that's my suggestion for your magic bullet.  Efficiency may demand
CIDR-style partitioning of the AKI space (or something along the lines
of Tony's a.b.c.d prefix, applied to AKI instead of DN), but that could
work by migrating certificates to the appropriate directory server(s)
by prefix WITHOUT any pre-arranged AKI partitioning of CAs.
EE certs could be referred to by "cert hash" instead of (or in addition
to) Issuer/Serial, and retrieved from the Directory the same way.

---

From: Stephen Kent <[email-masked]>
Date: Thu, 4 Mar 1999 11:57:51 -0500

David,

>name can be resolved unambiguously.

The Jan 99 survey suggests that the number is even bigger, about 12
million.  However, that is just the .COM entries, not all the hosts
registerted under each of the .COM domains, nor the folks in all the other
country domains, etc. .COM represents about 30% of the (accessible) DNS
entries, and that percentage may shrink as more TLDs are created, as more
hosts are registered in other countries, etc.

>in The Directory by that value.

But we know this does not scale well.

>to) Issuer/Serial, and retrieved from the Directory the same way.

I think one really wants partitioning along organizational lines, not the
arbitrary lines that the CIDR-like approach would imply.  Organizational
respobsibility for maintenance of directories has worked well for the DNS,
and if one were to create a PKI tied to the DNS, e.g., based on DNs that
employ only DC attributes, then I think we would want to make use of the
record types already defined for storage of X.509 certs.

Steve

---

From: Tony Bartoletti <[email-masked]>
Date: Thu, 04 Mar 1999 11:05:51 -0800

>record types already defined for storage of X.509 certs.

Stephen,

I see how "arbitrary partitioning" presents problems for distributed
responsibility of directory maintenance.  But these problems are rooted
in the nature of information the directories are designed to hold, and
begs the question "Why were they designed to hold such information."

As you say, organizational partitioning has worked well for DNS, but
then there is little of privacy concern over data in a DNS database,
and the naming scheme is almost arbitrary.  One should "trust" DNS
only as far as one might trust the entries in a phone book.  If I were
to look up a supposed building contractor from a phone book, I would
still require futher credentials (valid licence, no pending judgements)
before commiting to services.  If the entry in the phone book is bogus,
it is only a minor inconvenience, assuming I exercise diligence.

Certificate and Issuer look-up directories should do no more than this.
They should represent pointers to "tests for trust" and not be trusted
in themselves.  The "best practice" would be to automate multiple tests
through look-ups of independently managed directories, and use a form
of "majority rule" in making determinations of accuracy.

I am concerned about both the fragility and sensitivity of "trusted
directory services" which intend to globalize "meat-space" parameters,
especially geographic, country, state, address, etc.  I ask myself
"What is the worst someone could do, who has access to all of this
information?"

Apologies for not having enough details to make more specific comments.

___tony___

Tony Bartoletti                                             LL
Center for Information Operations and Assurance          LL LL
Lawrence Livermore National Laboratory                LL LL LL
PO Box 808, L - 303                                   LL LL LL
Livermore, CA 94551-9900                              LL LL LLLLLLLL
phone: 925-422-3881   fax: 925-423-8002               LL LLLLLLLL
email: [email-masked]                                   LLLLLLLL