On 07/27/2010 12:09 PM, Pat Farrell wrote:
Most of which we avoided by skipping the cert concept. Still, better
technology has nothing to do with business success.
Public Key Crypto with out all the cruft of PKI. Its still a good
idea.
that became apparent in the use of SSL between all the merchant servers and the
payment gateway. by the time the registration and setup process was completed
at both ends ... the certificate was purely an artificial attribute of the
crypto library being used. there were other issues with the payment gateway
protocol ... i was able to mandate things like mutual authentication ... which
didn't exist in the crypto library up to that point ... however the exchange of
certificates was so engrained that it wasn't possible to eliminate (even tho
all the necessary information already existed at both end-points).
the merchant server/browser part ... I could only recommend ... I couldn't
mandate.
my analogy is that certificates & PKI are electronic analogy of the letters of
credit/introduction from the sailing ship days ... when the relying party had no
other recourse for information about the stranger that they were dealing with. This
was left over from the dail-up email days of the early 80s (dial-up electronic
post-office, exchange email, hangup, and possibly have first-time email from
complete stranger).
that design point was quickly vanishing in the 90s with the pervasive growth of
the online internet.
I as at annual ACM sigmod conference in the early 90s ... and one of the big
sessions, somebody asked on of the panelists what was all this x.50x gorp about.
Eventually somebody explained that it was a bunch of networking engineers
attempting to re-invent 1960s database technologies .... with certificates being
armored, stand-alone, stale representation of some information from a database
someplace. In the later 90s, certificates attempted to find place in no-value
market niches (aka, situations involving no-value operations that couldn't justify
online &/or real-time information) ... although this got into some conflicts
... trying to address no-value market-niche ... at the same time claiming
high-value, expensive operation.
There were businesses cases floated to venture community claiming $20B
certificate market ... i.e. that every person in the country would have
$100/annum certificate ... some predicting that the financial community would
underwrite the cost. When that didn't happen, there were other approaches. We
had been called in to help wordsmith the cal. state electronic signature
legislation ... which was being heavily lobbied by the PKI industry to mandate
certificates.
I could that rube-goldberg OCSP was response to interaction I had with some of
the participants ... somebody bemoaning the fact that the financial industry
needed to be brought into 20th century requiring certificates appended to every
financial transaction. I responded that stale, static certificates would be
retrenching to before the advent of online, real-time point-of-sale payment
transactions ... aka a major step backward, not a step forward.
Besides the appending a stale, static certificate to every payment transaction being
redundant and superfluous ... it also represents enormous overhead bloat. There were some
reduced financial, "relying-party-only" certificates being floated in the
mid-90s ... which were still 100 times larger than the typical payment payload size
(increase the size of payment transaction payload by a factor of 100 times for no
beneficial purpose).
The X9 financial standard group ... had some participants recognizing the
enormous overhead bloat certificates represented in payments started a
compressed certificate standards activity ... possibly looking to reduce the
100 times overhead bloat to only 5-10 times overhead bloat (although still
redundant and superfluous). One of their techniques was that all information
that was common in every certificate ... could be eliminated. Then all
information that the relying party already had could be eliminated. I was able
to trivial show, that a relying party would have access to every piece of
information in a certificate ... and therefor digital certificates could be
compressed to zero bytes.
Then rather than arguing whether it was mandated that every payment transaction
have an appended certificate ... we could mandate that every payment
transaction have a zero-byte appended certificate.
disclaimer ... eventually had a couple dozen (assigned, retain no interest)
patents in the area of certificate-less public key (some showing up long after
we were gone) ... summary here
http://www.garlic.com/~lynn/aadssummary.htm
--
virtualization experience starting Jan1968, online at home since Mar1970
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majord...@metzdowd.com
