Policy-Discussion

[IanG <iang AT cacert.org>]

Hi Peter,


Peter Williams wrote:
> In the VeriSign CPS (for reference), those words mean (and they are
> pretty closely aligned to legal codes)
> 
>  
> 
> You “verify” the assertion of a signature (as authentic)
> 
> You “validate” the supporting certification chain (as reliable under the
> trust model)
> 
> You obtain assurance in the reliability of the trust model itself by
> considering the basis its authorities use in their assertion of validity
> (e.g. why and when they “issue” revocation/compromise/status notices)


I suspect that your use of terms here is more apropos the reliance
process, rather than the issuing process?


...
> A legal “recording” model lies at the heart of the VeriSign CPS’s core
> model of validity, and represents the basis of the assurance. Once an
> appropriate party performs an act of “recordation” (ugh, ugly American
> word that is however concise and effective), the verification and
> validation evidence becomes a record, whose status as such transforms
> the value of the assurance.


I think CAcert will head in that direction somewhat.  This is also
inspired by digital evidence thinking, whereby we are inspired to
both reduce the quantity of evidence and improve the quality of it.


> If you are interesting in  a somewhat overly-intellectualized
> consideration of validity, in a post-PKI era sphere, consider reading 
> http://yorkporc.spaces.live.com/blog/cns!5061D4609325B60!317.entry


Which says, amongst other gems, "When I wrote my PhD dissertation on
validation..."  just by way of a warning to us plebians :)

Hmmm... your description of validating authorities is interesting.

It seems to me that this would apply even to a software agent such
as a browser that took over most of the relying party
responsibilitie by dint of its display choices, and its verification
& validation activities.  E.g., Firefox as a Validattion Authority.

iang