Re: The future will be easy to use

At 03:30 PM 11/28/95 EST, Carl Ellison wrote:
> Of course.  This isn't the base case.  We would have some keys which I sign
> based on my own personal knowledge; things handed to me by people I know;
> some possibly published in the paper where the real key owner would see the
> claim and be able to contest it.

You are making the same erroneous assumption that Phil made when he
designed the Web of trust:  You assume that it is important and 
interesting to link key ID's to physical bodies.  This is usually
not the case:  Linking key ID's to home web pages etc is not only 
easier -- it is also usually more interesting and important.
 ---------------------------------------------------------------------
              				|  
We have the right to defend ourselves	|   http://www.jim.com/jamesd/
and our property, because of the kind	|  
of animals that we are. True law	|   James A. Donald
derives from this right, not from the	|  
arbitrary power of the state.		|   jamesd@echeque.com

-----BEGIN PGP SIGNED MESSAGE-----

>Date: Mon, 27 Nov 1995 23:05:29 -0800
>From: "James A. Donald" <jamesd@echeque.com>
>
>At 03:30 PM 11/28/95 EST, Carl Ellison wrote:
>> Of course.  This isn't the base case.  We would have some keys which I sign
>> based on my own personal knowledge; things handed to me by people I know;
>> some possibly published in the paper where the real key owner would see the
>> claim and be able to contest it.
>
>You are making the same erroneous assumption that Phil made when he
>designed the Web of trust:  You assume that it is important and 
>interesting to link key ID's to physical bodies.  

Thanks for that reminder.  I am actually not bound to the notion of keys
being only for people.  I'm a defender of the rights of disembodied
processes from way back :-).  However, this particular discussion was
focussed on people.

 - Carl

+--------------------------------------------------------------------------+
|Carl M. Ellison      cme@tis.com    http://www.clark.net/pub/cme	   |
|Trusted Information Systems, Inc.   http://www.tis.com/                   |
|3060 Washington Road          PGP 2.6.2:  61E2DE7FCB9D7984E9C8048BA63221A2|
|Glenwood MD  21738         Tel:(301)854-6889      FAX:(301)854-5363       |
+--------------------------------------------------------------------------+



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMLyKOVQXJENzYr45AQEzdAP/WcAaOE8RsxvNCnY0MBY0aqVboWPKU7aj
toairhNM7i5J+vacN30tBefU51+gmhQIdP3jRuArbSr0+xdrtNqiWBAiYaxiZz4X
g2/nUui2uaPuXF0tdXlN4ILSJQ0QV42mppOBXWjimcWXRioSQVBGxGS7X1tsPF+/
5AvEQha4h4I=
=MVIQ
-----END PGP SIGNATURE-----

On Mon, 27 Nov 1995, James A. Donald wrote:

> At 03:30 PM 11/28/95 EST, Carl Ellison wrote:
> > Of course.  This isn't the base case.  We would have some keys which I sign
> > based on my own personal knowledge; things handed to me by people I know;
> > some possibly published in the paper where the real key owner would see the
> > claim and be able to contest it.
> 
> You are making the same erroneous assumption that Phil made when he
> designed the Web of trust:  You assume that it is important and 
> interesting to link key ID's to physical bodies.  This is usually
> not the case:  Linking key ID's to home web pages etc is not only 
> easier -- it is also usually more interesting and important.

Not if you're encrypting a Credit Card transaction to ship physical 
goods.  In that case, I'm going to certainly want to link a key ID to a 
physical body (or at least address) if I'm the seller, so as to limit 
liability as best I can.

While this might not ultimately be important, early adopters of crypto on 
the net seem in general to be financially interested with an eye to limiting 
liability. They want linked keys.

There's a public-relations aspect to crypto which most systems not 
linking name -> key id fail.  This is the step necessary to get it out 
the door.

Unfortunately, it also appears counter to CP philosophy.

However, if you have optional linking of ID and name, shippers will only 
ship to keys with such attributes. Because just ID and address, it could 
be a "hit and run" type attack shipped to a safe maildrop.

Jon
------------------------------------------------------------------------------
Jon Lasser                <jlasser@rwd.goucher.edu>            (410)494-3072 
          Visit my home page at http://www.goucher.edu/~jlasser/
  You have a friend at the NSA: Big Brother is watching. Finger for PGP key.