Talk:Public key infrastructure
|
| Metadata here |
We need...
...an article titled "public key." :-) --Larry Sanger 13:54, 3 October 2008 (CDT)
- OK; added more redirects. Give me a little while as I am creating a series of articles with mutual definitions. Howard C. Berkowitz 14:09, 3 October 2008 (CDT)
Broader scope?
I think this needs to compare & contrast the typical hierarchical PKI and the PGP web of trust. The current text seems to describe only the former. Granted, most PKIs work that way and many people use "PKI" to mean exclusively that, but PGP's an important application, it uses a fundamentally different model, and there are arguments that its model is in some ways better.
For example, the opening paragraph currently has:
- The first essential element of PKI is that the creators of public-private keys key pairs have a secure way to store the public key in an accessible repository, with the stored key autheticated as coming from the purported source. The second essential element is that users of the public key have a secure way to retrieve the public key for a given source of information. As with any security tool, there must be a reliable means of auditing changes to the system resources, such as the entry of new keys, with a log verifying that the change was authenticated.
and all of that is indeed essential if the user is expected to trust the repository, to assume any key he gets from there is OK. However, if the user only trusts keys and does his own checking of signatures, then none of it is needed except perhaps for the tricky problem of managing key revocation. Sandy Harris 02:29, 9 June 2009 (UTC)
- I don't disagree that the PGP distributed trust model versus the hierarchical CA model are substantially different; I'm just not sure that PKI should be assumed to cover both. Could you suggest a "trust verification" or some other term that could cover both without conflicting with the IETF and other widespread use of PKI, which would become the top-level article with both paradigms as subarticles? Howard C. Berkowitz 04:34, 9 June 2009 (UTC)
- I'd say web of trust is the obvious title for an article on the PGP model; that's the only term I've seen used. I do assume PKI should cover both. I don't have a problem with the main PKI article covering only or mainly the hierarchical model, as long as it mentions web of trust and takes some care to distinguish which statements apply in general and which only in a hierarchy. Sandy Harris 09:57, 9 June 2009 (UTC)
- I'm going toward Official Ruling here, and suggesting that PKI is used in so many formal specifications, in the specific hierarchical context that derives from X.509 and other models, that I would be extremely reluctant to generalize it to include distributed trust. I'm more than willing to have an article on trust models, with PKI/hierarchical and web of trust/distributed subarticles under it. Redefining PKI is not a good direction. Analogies are always suspect, but when I generalized a concept, such as Vietnam wars, I deliberately did not overload a reasonably well-defined term such as Vietnam War. A new article title for the top level is fine; overloading a definition with extensive industry usage is not. Howard C. Berkowitz 10:27, 9 June 2009 (UTC)