[OAUTH-WG] RSA vs PKI?

[Brian Eaton <beaton at google.com>]

[switching subject line to fork discussion]

Hey Igor -

On Thu, Nov 5, 2009 at 7:49 PM, Igor Faynberg
<faynberg at alcatel-lucent.com> wrote:
> One question: Is RSA is really essential here? I  think not (why not use ECC
> or any other PKI algorithm instead?). So, I would agree with Brian so long
> as RSA is replaced with PKI.

Interesting point, and I'm not sure I fully understand what you are getting at.

The choice of RSA-SHA1 vs RSA-SHA256 vs ECC vs DSA-SHA1 vs <whatever
comes out next week> seems to be about cryptographic security.  What
algorithms do we want to use?  How are we going to migrate from older
algorithms to new algorithms as the old ones are broken?  What are the
efficiency vs security trade-offs?

PKI, on the other hand, doesn't seem to be about security in the
cryptographic sense.  It's more about key discovery, and trust.  How
do you find the consumer's public key?

Have I understood where you are headed?

Cheers,
Brian