'Weak' certificates

Folks (Ray in particular),

Back in March last year, Ray posted a discussion of some authentication requirements <http://www.ivoa.net/forum/grid/ 0503/0281.htm> (this is the same message I referred to in my other message today, but I'm following up on a different aspect of it here).

In that paper, Ray mentioned `weak certificates' as a way of allowing users to create relatively informal identities quickly: `It must be as easy for a user to create an identity (i.e. login) for oneself as it is for any typical commercial or community web site featuring a personal workspace (e.g. Travelocity, community blogs).'

Have you, Ray, been developing this idea since? I couldn't see any mention in the list archives apart from that thread.

The idea might effectively exist already, inasmuch as not all certificates are equal, and some make stronger warrants than other ones, without any technical distinction such as some being flagged as explicitly `weak'.

For example, Thawte <www.thawte.com> provide a range of certificates, from web server certificates down to `Personal e-mail certificates'. The former are high assurance, and appear to require the corporate equivalent of the passports and appointments that you describe; the latter are low assurance, and all the verification that's required is for Thawte to email you a random phrase, which you then enter into a web-page. These certificates contain an email address, and a CN of "Thawte Freemail Member"; all they actually assert, therefore, is that an email address exists, with what appears to be a human behind it. There are about half-a-dozen other certificates which Thawte describe, which vary in what's asserted, and with some of them having magic strings, such as "Domain Validated", in ON fields. Thus you can presumably tell the difference between them relatively easily, but none are marked as `weak' or `strong', and the only way you can tell what you may or may not rely on is by downloading Thawte's Certification Practice Statement <http://www.thawte.com/cps/> and reading through it.

A propos another remark in your 2005-03 paper, there is a mechanism for upgrading the anonymous email certificate into one with your real name attached, but it appears to involve the issue of a _new_ certificate, rather than the conversion of an existing one. I don't see that that's a problem, however -- you're presumably allowing access based on identity, rather than certificate hashes.

All the best,

Norman

-- 
------------------------------------------------------------------------ 
----
Norman Gray  /  http://nxg.me.uk
eurovotech.org  /  University of Leicester, UK