Subject: Re: [pkng] Proposal for a PKS (was Re: json-dsig anyone?)

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 01 Apr 2010 08:47:44 -0600

On 3/24/10 11:37 AM, Leif Johansson wrote:
> On 03/24/2010 04:24 PM, Massimiliano Pala wrote:
>
>> Is anybody interested in the idea ? Please let me know..
>>
> 
> yes!

Me, too.

---

From: "Thomas Hardjono" <[email-masked]>
Date: Thu, 1 Apr 2010 12:05:21 -0400

Folks,

I'm new to PKNG RG, but looking at the mail-list contributors it seem like the same usual suspects :)

Here are a couple of topics that perhaps the RG could look at.

(1) Simple certs:

A while back when I was involved in IEEE802.11 TGi and EAP-TLS, there was some discussion (complaints) about the "complexity" of current X.509 certs.  Non-PKI folks there just wanted a "simple X509" cert with a small number of fields. No policy related fields, no alternate names, no access control info, etc. etc.

Perhaps such a "simple cert" would go along way towards allowing my Mom/Grandma to understand it when she sees one :)

(2) Simple standardized "trust contracts":

I know people have been talking forever about a "flat hierarchy" or "bottom-up trust" (BUT) ala PGP and IM. See Leif's slides on PKNG.

In my experience, the flat or bottom-up trust model works for non-value transactions (like IM, FaceBook, etc). As soon as $$$ is involved, the parties will want to know where the buck stops (or who to take to court). 

It seems that in order to boot-up this notion of BUT, we need to also supply some limited stock/ready-made simple "trust contract", where person A will "trust" person B if both sides will digitally sign an agreed "trust contract" that is legally binding. This is one step further than the usual PGP-signing session at the IETF.

PS. When you sign-up to eBay, you are essentially signing-up to some legal contract that limits eBay's liability. Same with buying a cert from VeriSign (see its CPS).

Would this item be in-scope for PKNG?

/thomas/

---

From: "Thomas Hardjono" <[email-masked]>
Date: Thu, 1 Apr 2010 13:15:04 -0400

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Thomas Hardjono
> Sent: Thursday, April 01, 2010 12:05 PM
> To: [email-masked]
> Subject: [pkng] Some topics for PKNG
> 
> 
> 
> I know people have been talking forever about a "flat hierarchy" or
"bottom-
> up trust" (BUT) ala PGP and IM. See Leif's slides on PKNG.
> 
> In my experience, the flat or bottom-up trust model works for non-value
> transactions (like IM, FaceBook, etc). As soon as $$$ is involved, the
> parties will want to know where the buck stops (or who to take to court).
> 
> It seems that in order to boot-up this notion of BUT, we need to also
supply
> some limited stock/ready-made simple "trust contract", where person A will
> "trust" person B if both sides will digitally sign an agreed "trust
contract"
> that is legally binding. This is one step further than the usual
PGP-signing
> session at the IETF.
> 
> PS. When you sign-up to eBay, you are essentially signing-up to some legal
> contract that limits eBay's liability. Same with buying a cert from
VeriSign
> (see its CPS).

Here is a pointer to efforts along the last item (simple contracts
exchange):

http://wiki.openid.net/Contract-Exchange#ContractExchangeWGCharterformallyTX

/thomas/

---

From: Leif Johansson <[email-masked]>
Date: Fri, 02 Apr 2010 08:21:45 +0200

> http://wiki.openid.net/Contract-Exchange#ContractExchangeWGCharterformallyTX

I'm very interested personally (this notion was one of the subjects of
a discussion at the recent ISOC maping the gaps workshop) but I'm not
sure it qualifies as work for pkng. It feels more like a natural 
application of any PK-based technology...

	Cheers Leif