Trustworthy contacts

[Dave Bird]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In article <0866jAA9zgu5EwIS@oxted.demon.co.uk>, George Foot
<georgefoot@oxted.demon.co.uk> writes
>But dual key methods are a technical innovation introduced by
>technical people which has lamentably been seized upon by
>energetic but shortsighted interests as a basis for a e-commerce
>framework which has been enshrined in law before it has been tested
>in practice. 
>
>This is a wrong approach as is demonstrated by the difficulties in a
>military context (mentioned elsewhere in this list) which have only
>resolved by human (as distinct from machine) intervention.
>A vast machine for establishing trustworthy contacts will fail.

Do you mean that no mechanism can be established?  I disagree.

There are several elements of trust.......

(a) being assured that what I have received as the public key for Rufus
really is what was issued as the public key for Rufus,& (a2) that the
issuer really is a real-life person I know or have been introduced to;
(b) given I am sure I have the right key, that I can assign a degree of
confidence to reports received from that key or a credit limit to
purchases made with that key.

Be assured that, setting aside keys for the moment, we usually have the
means of identification and checking to verify that a person is who he
says he is, via identity documents or public listings or introductions
of various kinds -- obviously we would make more or less checks
depending how much was at stake in the transaction.  And we can usually
check a credit limit [usually because the person's credit-issuer has
done it for us].  

Why is it so hard to do these things when public keys are introduced
into the system?  Really we are only assessing the technical usefulness
of keys as ONE MORE ELEMENT ADDED TO THE CONVENTIONAL SYSTEM.  We can
fall back on identifying a key, or its proxy the fingerprint, by
personal meeting or paper signature or phoning a person whose voice 
we know... much as we would verify any other matter.  If we are
satisfied the digital signature process is   ** mathematically **
sound, then we can also add that as well as phone, paper, or meeting
as a means of certifying introduction.

As to where we get introductions.... other than keys, already, we get
them from corporate authority underwriting an employee, from public
directories, from the bankers of a person seeking credit, from a
friend introducing his friend, and so forth.  With different degrees
of personal or financial confidence according to the means used.
We do it already.  We merely have to add the technical element of
keys to this.  Why is that so difficult?

- -- 
   ^-^-^-@@-^-;-^   http://www.xemu.demon.co.uk/
        (..)__u     news:alt.smoking.mooses

-----BEGIN PGP SIGNATURE-----
Version: PGPsdk version 1.7.1

iQA/AwUBObo1fH8v/Y5zkfRPEQLmlwCgxlPKpfp56xXlpUDUkcHUERrRr8sAn0e0
HwlzuMWFV/yXS7NSc/7Zbbkq
=gzkd
-----END PGP SIGNATURE-----