Subject: Re: Certificate requests for encryption keys

From: Graham Klyne <[email-masked]>
Date: Mon, 14 Jun 1999 11:35:17 +0100

At 05:57 12/06/99, Peter Gutmann wrote:

>Since the distribution now includes new people (ietf-smime) I'll give the 
>Readers Digest version of what I said in an earlier message:

Thanks for that.

>[...]   and since I'm pretty picky about 
>doing things the way PKIX requires the only way they could get self-issued 
>certs to work is to make everyone a CA.

Time for a dumb question, if I may.

What is the problem with this?  Unless I'm missing something (likely :-),
being a CA is no big deal security-wise.  I don't see any special trust
conferred on that basis alone.

#g

---

From: Dan Geer <[email-masked]>
Date: Sat, 26 Jun 1999 23:45:18 -0400

>doing things the way PKIX requires the only way they could get
    >self-issued certs to work is to make everyone a CA.

    What is the problem with this?

My colleague Don Davis & I have discussed this as early as
1996, see http://world.std.com/~dtd/scca/smartcard_ca.ps

In my view, there is nothing wrong and much right...

--dan