To:
Derek Atkins <warlord@MIT.EDU>
cc:
Keith Moore <moore@cs.utk.edu>, Steve Hanna <steve.hanna@sun.com>, Simon Josefsson <simon+keydist@josefsson.org>, Edward Lewis <lewis@tislabs.com>, keydist@cafax.se
From:
Keith Moore <moore@cs.utk.edu>
Date:
Mon, 14 Jan 2002 18:55:45 -0500
In-reply-to:
Your message of "14 Jan 2002 18:42:23 EST." <sjm4rlosdnk.fsf@kikki.mit.edu>
Sender:
owner-keydist@cafax.se
Subject:
Re: looking for draft volunteers
> My point is that I think it's ok if we only solve > the casual use problem. I think if we only solve the casual use problem, without defining more trustworthy mechanisms, then marketers will tell customers that the products that use these mechanisms are "secure", or "trustworthy" when they're really only epsilon more trustworthy than what we have now. OTOH, if we design a framework that allows multiple degrees of trust, and multiple paths for establishing trust, the same products that provide a casual level of security for things authenticated solely by DNS, can also provide a higher level of security for things authenticated by more trustworthy means. Keith