RE: TAA definition

[Black_David@xxxxxxx]

> >As for the TAA definition, how about:
> >
> >A Trust Anchor Administrator (TAA) is the entity represented by the
trust
> >anchor.  The TAA controls the private key of the trust anchor.
> 
> A public key with associated crypto parameters and associated 
> restrictions do not "represent" anyone.
> 
> Further, this definition breaks the model we have been discussing, 
> where a TAA gives the client one or more TAs for the client to 
> install. This definition causes the client to now have many TAAs, one 
> for each TA they installed.

I agree.  A Trust Store Anchor may correspond to a TAA, but the trust
anchors that are installed clearly do not (e.g., Verisign's trust
anchors will be installed by a lot of entities that aren't part of
Verisign).
 
> Going back to the definition presented in Chicago:
> 
> A Trust Anchor Administrator (TAA) is an entity which gives trust 
> anchor instructions to clients.
> 
> This says that anyone can be a TAA, although obviously a particular 
> client will only listen to one or a small number of TAAs.

And if we want to formalize local identification and authorization
of the TAA, I suggest introducing the concept of a Trust Store Anchor.

Thanks,
--David
----------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
black_david@xxxxxxx        Mobile: +1 (978) 394-7754
----------------------------------------------------