[Previous] [Next] [Index]
[Thread]
Re: Netscape Changes RSA tree
I agree with Mark. Again, doesn't PGP support a model headed toward:
this signature contains certificates A, C, X
i trust A x units, C y units, and X z units for a total T=f(x,y,z)
that's above my minimum threshold ofr this class of exchange
so I trust this signature for this purpose.
Could get pretty messy pretty fast, but it seems to me something akin to
how we do it in our heads. Anybody given though to a practical approach?
> Why are you designing the tree part into your system? It doesn't
> really help, because I still need to consider how much I trust a given
> CA's certification policy.
>
> It also limits things unnecessarily. If MIT's organizational CA fits
> the policy for more than one "tree", why not allow it to be part of
> both? And regardless of all that, I might choose to sign a relative's
> or friend's key directly. I don't want to have one key pair as my
> "Marc's CA" key, and another for day to day operations. (Actually, I
> probably do, but I should be free to make that decision.
>
> Tell me again what's wrong with a plain web? You almost certainly
> want to have well-known policy bits encoded in each signature, but
> that's not something you hardwire into the design.
>
> Marc
Dave
References: