Subject: RE: Proxy PKI.

From: Trevor Perrin <[email-masked]>
Date: Wed, 22 May 2002 11:50:19 -0700

Or maybe a CA is just a proxy in disguise!:  A CA receives an "authenticated
message" from a client, which just happens to be a public key, and signs the
message, while specifying who he is signing on behalf of.

Now allow the client to send a hash of a document, instead of a public key.
Imagine that the CA signs and returns a "certificate" which has this
document hash instead of the public key.  This "certificate" would specify
the name of the client and the policy under which the certificate was
issued, it would have a serial number so it could be later revoked, and
could be processed by the relying party as part of the certificate path.

In other words, a certificate says "this public key is associated with this
person under this policy".  Maybe we could generalize this structure to make
statements about things besides public keys.

Also, whereas a certificate is a declarative statement about an operation
performed by a TTP in the past ("I authenticated the client with a password,
he said this"), maybe you could invert the notion of a certificate to get a
structure which is encrypted to a TTP instead of signed by one, and is an
imperative instead of declarative statement ("authenticate the client with a
password, tell him this").  Ie, instead of saying "this client WAS bound to
this hash", it would say "this client SHOULD BE given this symmetric key".
Which is a kookier notion, but I actually think it makes a little sense..

This is discussed, not that coherently, in 4.1/4.2:
http://www.sigaba.com/products/whitepapers/delegatedCrypto.pdf

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Wednesday, May 22, 2002 11:03 AM
To: Trevor Perrin
Cc: [email-masked]; [email-masked]
Subject: RE: Proxy PKI.

aka from trust standpoint, the described proxy PKI is a certification
authority in disguise ... implying possibly it might be in need of things
like CPS.

---

From: Stephen Kent <[email-masked]>
Date: Wed, 22 May 2002 18:52:11 -0400

Trevor,

The model you propose may be appropriate for some set of 
circumstances, and for some forms of PKI-enabled applications. But, 
it is does not match the semantics usually associated with X.509 nor 
PKIX. This becomes increasingly apparent as you continue your 
explanations. There have been other PKI models proposed, e.g., SPKI, 
and you are free to develop a model based on the notions you espouse, 
but I do not envision PKIX making changes to our standards to 
accommodate what you propose.

Steve