DIgital Signatures

[Carl Ellison]

-----BEGIN PGP SIGNED MESSAGE-----

   From: "Brian Gladman" <gladman@seven77.demon.co.uk>
   Date: Sun, 30 Aug 1998 12:21:02 +0100

   There have been a useful exchange of views on this list over recent days
   on the issues of bringing digital signature technology into widespread
   use.  An important aspect that many of the posts have clarified is that
   there are two central issues of principle in gaining confidence in
   (cryptographic) digital signature primitives:

	[... -- two kinds of binding between keys and people ]

I am connected to my ISP via SSH, as I read this, and I used public key
authentication to do that connection.

I remember thinking, as I connected using a digital signature, that the
whole PKI technology issue may be hype.  If we started with individual
applications, as Tatu did with SSH, would we ever have come up with a need
for an identity-PKI?  Would we even have come up with a need for
authorization certificates (ala SPKI)?  Our needs may have been met for a
long time, just by PGP key signing and hand delivery of keys, with
keys in an ACL the way SSH does it.

Of course, I'm not sure I believe that -- but the thought did hit me and I
thought I'd share it.

 - Carl


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: mailcrypt-3.4

iQCVAwUBNenAhRN3Wx8QwqUtAQGCpAQAgVJT3UJR2SPNxiiAcx8auol1SWjlNpIE
lDa/jOhpNgELlGl55TZpUaQIPt6sgXK+FxQbW8gQL5WmO7SN5ExBFzJg5Myt+q8e
VFY2sZ+qi1Tdv/UpwDgw+tCyxVkG/x3N80pImuJ/DlbfA378khwTdKtBpKWDvTnM
Y0HyCRJR80E=
=chiG
-----END PGP SIGNATURE-----