On Tue, Sep 22, 2009 at 09:27:49AM -0600, Smith, Donald wrote: > Don't we all end up having to trust the same set of RIRs? We have > to trust more then just the one we choose to sign the certs. We > have to trust the set that other ISPs trust too or not accept their > certs unless I am missing something here.
Yep, just like the browsers which come loaded with a bunch of CA’s.
> Difficult to sell is putting it mildly. Most ISPs don't run CAs
> today nor do they have the infrastructure to do so. Neither will
> they want to turn over any aspect of routing control to a 3rd party.
And then there is the whole issue of how hard or easy it will be to
configure routers to actually use this stuff! Keep in mind, most ISP
engineers are not PKI experts (nor security experts!).
-Jeff
--
========================================================================
Jeffrey I. Schiller
MIT Network Manager
Information Services and Technology
Massachusetts Institute of Technology
77 Massachusetts Avenue Room W92-190
Cambridge, MA 02139-4307
617.253.0161 - Voice
[email protected]
========================================================================
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ sidr mailing list [email protected] https://www.ietf.org/mailman/listinfo/sidr
