Re: [TLS] the use cases for GSS-based TLS and the plea for integrating

[Martin Rex <Martin.Rex at sap.com>]

pgut001 at cs.auckland.ac.nz wrote:
> 
> For how many more years do we have to keep flogging the PKI corpse?  If it
> worked as intended, the multibillion-dollar phishing industry wouldn't exist.
> Why keep it mandatory to implement something that very demonstrably doesn't
> work?

I beg to differ.

PKI does work.  However, the marketplace has different preferences
for a number of good reasons (IPR issues and operational costs among them).

secret-key or shared-secret authentication comes in all different flavours
and every human being learns the concept behind at a young age and
not necessarily as a software implementation.

public key technology and authentication through public key technology
is different and its complexity appears to be beyond the scope of
many non-technical people.  Where it is used, pushed and advertised,
it is often a part of a MUCH more complex thing called PKI and
cluttered with the ridiculous bloat called X.509 certificate and
the concept of "trusted (certification) authorities".


If Public Key technology was more along the line of the original
models of SSH and PGP, it would likely be used much more often.


-Martin

_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls