Subject: RE: Finding PKIX Servers!

From: Andrew Probert <[email-masked]>
Date: Mon, 8 Feb 1999 12:27:31 +1100

Comments inline

Andew Probert
Rotek Consulting   http://www.rotek.com.au
a Division of Secure Network Solutions
Tel  +61 3 9690 8877
Fax +61 3 9690 8171

> -----Original Message-----
> From:	Perry E. Metzger [SMTP:[email-masked]]
> Sent:	Monday, February 08, 1999 11:36 AM
> To:	Andrew Probert
> Cc:	[email-masked]
> Subject:	Re: Finding PKIX Servers!
> 
> 
> Andrew Probert <[email-masked]> writes:
> > My thoughts run to business requirements like world-wide EDI trading,
> > shipping around contracts and documents, which require an integrated
> global
> > infrastructure.
> 
> No it doesn't. In fact, a global infrastructure is totally unneeded
> for this.
> 
> This sort of claim shows up all the time among people who haven't
> actually analyzed the real needs of real businesses. The truth of the
> matter is that no global PKI is either needed or desirable.
> 
	[Andrew Probert]  Real businesses pay me real $$ to analyse and
develop PKI systems, I have personally been involved in establishing EFT and
banking infrastructre.  So please dont make assumptions about my reality!
Others I know also get paid to analyse and their reality appears the same as
mine.

> When people trade, they don't care about identities. They care about
> things like getting paid. 
	[Andrew Probert]  .. and if they dont get paid they care about
tracking back in an evidence sense to stick it to the identity.  Otherwise
its written of as a bad debt against a scheme operator.  They also care
about the validity of an order, the authority of the person to order etc,
floor limits, per card limits, to constrain risk.
> That means you need a working banking
> infrastructure, not a PKI. Public key methods can help assure a
> transacting entity that its bank will pay it if it presents an
> electronic draft, or to help a transacting entity order the creation
> of such a payment, but such protocols are necessarily bilateral.
> 
	[Andrew Probert]  Yes I agree a working banking infrstructure is a
pre-requisite for a public key based system like SET to actually work and
there's a lot for SET to replace.  EFTPOS device key management, host EFT
switches, a globally interconnected network of EFT switches, the Card
Numbering scheme of EFT that has a card prefix, so that transactions can be
routed to their home EFT switch in whichever country it was Issued.

	All of this to support "ONLINE AUTHORISATION"

> To put it another way: when you walk in to the book store to buy a
> book, the store doesn't care a bit about who you are. They care about
> whether they will be PAID, and knowing you have a valid cert tells
> them nothing about that. 
	[Andrew Probert]  It tells them, by its IssuerName, who issued it to
you.  By inference, you can assume that they signed a subscriber agreement
under the CA policy.  In the case of a bank issuing the cert, its a closed
loop.  I dont see Certs issued by non-Banks being honoured by banks..
> What they need is a signed statement from their
> accepting bank saying they will be paid -- and that doesn't require a
> Global PKI to set up. 
	[Andrew Probert]  Consider SET, it very much does require a global
infrastructure albeit, I agree the banks will do their own thing as regards
PKI.
> It might use a PKI set up by the bank or credit
> network for its own use, but it doesn't need a *GLOBAL* PKI.
> 
	[Andrew Probert]  Banks dont need global PKI, as they will set up
their own.  Others do, for lessor things.

> Perry

---

From: "Perry E. Metzger" <[email-masked]>
Date: 07 Feb 1999 20:41:59 -0500

Andrew Probert <[email-masked]> writes:
> develop PKI systems, 

Thank you, we all have banking industry clients and
credentials. Arguing based on them isn't useful.

> tracking back in an evidence sense to stick it to the identity.

No, actually. They want to get paid. Once they've been ripped off
they're screwed. The big cost in commerce is paying for fails. When
you have a fail, human time starts getting expended in big chunks, and 
it costs a lot per hour. If you are at the point where you've had a
fail to deliver -- if your system even creates them particularly often 
-- you're already dead.

>  Otherwise

And none of that is revealed by a PKI. The only way to determine most
of it is with online systems.

In his talk "Electronic Commerce needs no PKI" (now given several
times), Win Treese noted that most of what the Global PKIs provide
isn't something the merchants need or want, and has nothing to do with 
the success or failure of electronic commerce deployments. I've heard
similar arguments made by a lot of other people -- enough that I no
longer think I'm crazy for saying this.

> pre-requisite for a public key based system like SET

SET is a dead albatross hanging around Visa's neck. It is not ever
going to be deployed for real. Why are you even bringing it up?

> you.

And they don't care about that. They want to know if they are going to 
be paid, and whether First Sillybank or the National Bank of Gnats
issued the card isn't interesting to them. All they want to know is if 
the accepting bank will hand them money, period, and that depends
entirely on interactions that are way past the merchants level of the
transaction. Indeed, even a valid card can be totally overdrawn, so
mere validity is uninteresting.

> 	[Andrew Probert]  Consider SET,

SET is dead.

> their own.  Others do, for lessor things.

Who? For what?

Perry