<html><body bgcolor="#FFFFFF"><div>Hi, Lucky, good to see some perspective!</div><div><br></div><div>On 08/09/2011, at 8:52, Lucky Green <<a href="mailto:shamrock@cypherpunks.to">shamrock@cypherpunks.to</a>> wrote:<font class="Apple-style-span" color="#0023A3"><font class="Apple-style-span" color="#000000"><br></font></font></div><blockquote type="cite"><div><span></span><span>o Changes to OCSP</span><br></div></blockquote>.....<br><blockquote type="cite"><div><span>The</span><br><span>problem was that the top three CA vendors at the time, RSA Security,</span><br><span>VeriSign, and Netscape didn't have a comprehensive database of</span><br><span>certificates issued by their software and were only able to generate</span><br><span>blacklist-based CRLs. During the IETF process, OCSP was therefore</span><br><span>redesigned as a bug-compatible front end to be fed by those CRLs.</span><br></div></blockquote><div><br></div><div>Influence on institutional lines, or design on security lines?</div><div><br></div><div>Now, there is some merit in this, in that turning OCSP into an oracle of the certificate database has privacy and security consequences. But, read on...</div><br><blockquote type="cite"><div><br><span>But that's the best the majority of CA vendor products architecturally</span><br><span>could provide at the time, which caused the IETF process to arrive at</span><br><span>the "rough consensus" that became known as OCSP. The consequences of </span><span>that decision are hounding us to this day. OCSP needs a redesign.</span><br></div></blockquote><div><br></div><div>In this conclusion, I disagree, or at least wish to propose another conclusion & implied question.</div><div><br></div><div>IMO, it is revocation that needs a redesign. Not OCSP, and here's a small hint of evidence:</div><div><br></div><span class="Apple-style-span" style="-webkit-tap-highlight-color: rgba(26, 26, 26, 0.296875); -webkit-composition-fill-color: rgba(175, 192, 227, 0.230469); -webkit-composition-frame-color: rgba(77, 128, 180, 0.230469); "><blockquote type="cite"><div><span>Quoting myself here from those days: "learning in 80 ms that the</span><br><span>certificate was good as of a week ago and to not hope for fresher</span><br><span>information for another week seems of limited, if any, utility to us or</span><br><span>our customers".</span><br></div></blockquote></span><div><br></div><div>(order rearranged ;)</div><br><blockquote type="cite"><div><span>o Static lists of trusted CAs</span><br></div></blockquote><div><br></div><div>(I think I've noted elsewhere, this is revocation, but at a higher layer. Whatever we decide there, applies here. And, read on...)</div><div><br></div><br><blockquote type="cite"><div><span></span><span>o Gobal CA</span><br></div></blockquote><div><br></div><div>Yeah, but the train has already left that station.</div><div><br></div><div>In the beginning, vendors ran a "list" of roots. CAs applied and were added, no problem. It was just a list, right?</div><div><br></div><div>Over time, this migrated to a fully fledged governance operation with policies, reviews, contracts, liabilities, bureaucracies, delays, costs and recently, *revocation* .</div><div><br></div><div>In short, vendors are the new meta-CAs. They just haven't agreed to that as yet. However, IMO, this situation is embedded and developing, unstoppable. The train will reach that station soon enough.</div><br><blockquote type="cite"><div><span>Also known as meta-CA, CA-CA, single trusted root, and "the turtle on</span><br><span>which all other turtles stand",</span></div></blockquote><div><br></div><div>Yes, we lack an agreed term.</div><div><br></div><div>(with a nod to peter's sense of humor, I suspect the europeans and latin americans will find that CACA smalls ... )</div><div><br></div><blockquote type="cite"><div><span>Until the next episode of "PKI "fixes" that don't fix PKI",</span><br></div></blockquote><div><br></div><div>Thanks!</div><div><br></div><br><blockquote type="cite"><div><span>--Lucky Green</span><br></div></blockquote><br><div><br></div><div>Iang</div></body></html>