At 5:44 PM -0700 8/20/07, Frank Siebenlist wrote:
Why do we need the emphasis on "public key" and "digitally signing" with respect to trust anchors? I can think of trust anchors that could be identified through a kerberos principal name or a DN, and online trust anchors that can be queried for info over an authenticated tls connection... -Frank.
Frank,The notion of trust anchors has been, for the last 15 years or so, a purely public key notion. So yes, I would argue that if we want to work on what it going to be called a trust anchor management protocol, it needs to be based on public keys and signature validation. If folks want to do something else, make up a new name, this one is taken :-).
Steve