Subject: RE: AW: self-signed TSA [Was Re: Private Key Cloning]

From: Michael Zolotarev <[email-masked]>
Date: Mon, 26 Jun 2000 09:44:19 +1000

It is not a PGP-model. I register my direct trust a self-signed CA
certificate - is it PGP? Of course not. So why are you saying that trusting
to a self-signed TSA certificate is PGP?

Are we trying to limit issuing self-signed certificates to CA only,
PKI-wide? The same arguments apply to any non-CA service, such as Attribute
Authority, don't they?

> -----Original Message-----
> From: Peter Lipp [mailto:[email-masked]]
> Sent: Saturday, June 24, 2000 9:41 PM
> To: Rich Salz; Aram Perez
> Cc: PKIX
> Subject: AW: AW: self-signed TSA [Was Re: Private Key Cloning]
> 
> 
> > > If I take your statements/conclusions below to their extreme,
> > then anytime
> > > PKIX comes up with a new service that uses digital signatures,
> > that service
> > > would have to issue its own self-signed certificates. I don't
> > see the OCSP
> > > folks requesting their own self-signed certificates.
> >
> > Not HAVE TO issue, but COULD issue.  Most definitely.
> 
> Yes. And I could also issue my self-signed certificate, and 
> you would have
> less problems trusting me because you would not need to 
> bother with the
> obscure cert I might have from some CA service. Welcome to 
> the PGP-model!
> 
> Peter
> 
> 
>

---

From: "Peter Lipp" <[email-masked]>
Date: Mon, 26 Jun 2000 10:09:19 +0200

> certificate - is it PGP? Of course not. So why are you saying
> that trusting to a self-signed TSA certificate is PGP?

Because if every PKI-service (TSA, OCSP, SCVP, ...) signs their own
certificate, and if I have to verify trust into each and every one of them
separately, and that smells PGPish and not PKIXish. Strictly speaking it is
not PGP, but if I extrapolate and allow you to register your direct trust
into my personal self signed CA certificate, we are very close to PGP,
aren't we? And I don't care about the data formats here...

Peter