[saag] Re: wpkops, "WebPKI" and citations

On 11/17/2025 12:12 PM, Salz, Rich wrote:
> 
> * Might not be quite enough, but if that was in some place I could cite, I'd be
> * happy.
>
>
>
> http://www.richsalz.com/ietf/what-is-the-web-pki/ <f70d4e31-eb89-4050-8e17-e7a4b2686c36>

Rich, I don't think that's a good operational definition. If we applied 
it to "the road infrastructure", it would translate to "The collection 
of entities — roads, those running cars, and users who often use public 
transports — that send and retrieve information across the country." 
That does not sound quite right.

We can certainly isolate pieces of the infrastructure: CAs, browsers 
that ship with embedded lists of trusted CA, crypto stacks that 
implement verification logic and may incorporate default lists of CAs. 
But websites and users, no, not so much, at least not in a general 
sense. They do use the web PKI infrastructure but they are not it. 
Websites, for example, are not exactly at liberty to get site 
certificates signed by arbitrary authority. If they do not chose a CA 
that is part of "the infrastructure", browsers are going to punish them. 
Users may perhaps decide to trust sites outside of the infrastructure, 
but that's like saying that I can decide to not use public transport 
service and rely on my sailboat instead. it does not make my sailboat 
part of the road infrastructure...

-- Christian Huitema

_______________________________________________
saag mailing list -- [email protected]
To unsubscribe send an email to [email protected]