Subject: RE: Proxy PKI.

From: [email-masked]
Date: Wed, 22 May 2002 09:41:31 -0600

and of course the other case for Proxy PKI is where there is a hierarchy of
trust .... like in B-to-B scenario and the proxy may implement some number
of business rules in addition to authentication on subordinate trust units
(like a corporate purchasing department approval iinfrastructure). From a
design standpoint the authentication paradigm (password or digital
signature) on inbound requests from subordinate trust units should be
transparent to the outbound digital signed requests. top-level trust units
(say in b-to-b corporate scenario) shouldn't care about the internal trust
mechanism and/or even that their are subordinate trust units. This is
sort-of like inverting the standard CA trust hierarchy ... rather than the
CA distributing static proxy trust certificates to each individual .... and
each individual distributing the static proxy trust certificates with each
of their signed messages .... the individuals send each authenticated
message directly to the CA-equivalent  ... and the CA does real-time rules
in addition to the authentication operation before replacing the
lower-level trust authentication with their own digital signature and
sending it on. In this sort-of inverted trust paradigm, each message
becomes a little like a real-time certificate (and the originating
subordinate trust unit information doesn't even have to be propogated). The
trust paradigm is still with the entity applying the (final) digital
signature ... regardless of whether it chooses to use a single key-pair or
a multitude of key-pairs creating the facade of multiple entities
(simulating each of its sub-ordinate trust units).