Thread View: sci.crypt
3 messages
3 total messages
Started by Marc.Ringuette
Wed, 26 Aug 1992 17:20
Re: User authentication
Author: Marc.Ringuette
Date: Wed, 26 Aug 1992 17:20
Date: Wed, 26 Aug 1992 17:20
41 lines
2790 bytes
2790 bytes
Carl writes, > That's a different point, though. What I'm trying to point out is that you > deal with me in a very real sense but you've never met me and aren't likely > to. Therefore, we don't need physical contact in order to communicate. ... > If I can move money around with only my key and get caught in a love > triangle with only my key, what more do I have to do? :-) I disagree with the strong form of your claim, Carl, but agree with a weak form. If your claim is "It doesn't matter if someone is intercepting all our messages; one electronic entity is the same as any other," then I disagree. Many people trust their ability to tell "what kind of person" is on the other end of the wire, after they've corresponded for a while. There's a world of difference, to such a person, between "you" and "you plus a thousand people listening in, including the FBI and the Washington Post". But I agree with the weaker claim, that it's reasonable to correspond with and trust an electronic persona. We should therefore strive to provide a means by which each persona-owner can make sure that his or her persona is being accurately transmitted to the world. My secure newsgroup, if it works, could do this. "Persona Certificates", as proposed for the PEM project, are another way. They would allow people to register "persona" public keys, labeled as such, using the same certificate mechanisms as for personal or organizational use. I think personas reliably associated with public keys are a good thing. However, I believe there are times when it's still a very good idea to require a person's physical presence. It takes 20 years to create a person. It takes 20 minutes, or perhaps 20 hours or 20 days, to create a fictitious electronic person complete with a history of correspondence. It all depends on how much stability you need, I guess. [ Marc Ringuette | Cranberry Melon University, Cucumber Science Department ] [ mnr@cs.cmu.edu | 412-268-3728 | ".surivorter erutangis a ma I" ] [ ripem public key: ] [ MFkwCgYEVQgBAQICAgADSwAwSAJBALu5OFJmAZ4hhNMBXyA5YeMBQFZhbXJ7yapG ] [ VkAqMMGmyAx2k2A7EfLgwu9NRqDYCyTdwDXU5lvPLG7o36Lnw6UCAwEAAQ== ] [ ripem is unix-based, using RSA and a PEM-like format; send mail for info. ]
Re: User authentication
Author: D. J. Bernstein
Date: Thu, 27 Aug 1992 00:31
Date: Thu, 27 Aug 1992 00:31
28 lines
1864 bytes
1864 bytes
If you never ask the question ``Who are you?'' then you will never be given a false answer. For *the overwhelming bulk* of human communication it has not proven necessary to ask the question. So it is silly to design a ``public-key infrastructure'' which forces people to ask the question---and suffers all the attendant problems of false answers. When you use a public-key system, think of your messages as being sent *from one key to another*. Accept that you don't know ``who'' controls the keys that your keys are communicating with. You'll find that you don't need to know. For *special cases* such as credit transfers the credit-granting organization can and should set up an association between what it considers ``real people'' and keys. And for hunting down criminals one certainly wants link-level security, so as to be able to trace any signal to its source. But there is no need for global identities, or even identities shared between two organizations. If you hear that IBM just did something, do you care what *real people* are involved in making that decision for IBM? You might, but IBM doesn't have to tell you, and business will go on even if you don't know. The only problem---the problem that public-key cryptography solves---is that somebody else might pretend to be IBM, the IBM you already know, without IBM's approval. If IBM signs its messages then this problem disappears. ---Dan (or so je m'appelle in this forum)
Re: User authentication
Author: Hilarie Orman
Date: Thu, 27 Aug 1992 21:43
Date: Thu, 27 Aug 1992 21:43
5 lines
520 bytes
520 bytes
In article <9208261827.AA02445@news.cis.ohio-state.edu>, Marc.Ringuette@daisy.learning.cs.cmu.edu writes: |> It takes 20 years to create a person. Please note that mileage may vary.
Thread Navigation
This is a paginated view of messages in the thread with full content displayed inline.
Messages are displayed in chronological order, with the original post highlighted in green.
Use pagination controls to navigate through all messages in large threads.
Back to All Threads