Hello, I would like to say first that my X.509 understanding is orders of magnitude lower that that of OpenPGP. So I hope this makes sense to you...
This idea came to my mind while I was wondering why several CAs offer free (but rather useless...) certificates for X.509 but not for OpenPGP. Whatever they do with X.509 can be done with OpenPGP, too (e.g. setting an expiration date for the signature). How much effort can it be to offer both? Then I realized that they could do that but that a CA signature for an OpenPGP certificate is rather useless in today's situation: Most of the value of an X.509 certification is the pre-installed root CA pool. A certification by a non-pre-installed CA is typically less useful than an OpenPGP certification. Now my point: Keys can be converted from one format to the other. The fingerprint changes but obviously the keygrip doesn't. I believe it would make a lot of sense to create a connection between gpg and gpgsm and point gpgsm to the OS's and / or browser's root certificate pool. Then a CA could offer its certificate in OpenPGP format (even conforming to some new "standard" which makes it easier to detect this special kind of certificate e.g. by using a comment or signature notation pointing to the related X.509 certificate), and GnuPG could easily realize that it is the same key. This would relieve the user from the hard decision whether a certificate is valid (the CAs OpenPGP certificate in this case). The user would just have to decide (like with any other OpenPGP certificate) whether he wants to trust this CA (and how much). By doing so the pre-installed CA pool would become valuable for OpenPGP, too, and it would make sense for the CAs to offer certifications for OpenPGP certificates, too. Maybe there are other reasons for some CAs, too. But I assume this would be rather little effort and could close much of the gap to S/MIME's convenience. Hauke -- Crypto für alle: http://www.openpgp-schulungen.de/fuer/unterstuetzer/ http://userbase.kde.org/Concepts/OpenPGP_Help_Spread OpenPGP: 7D82 FB9F D25A 2CE4 5241 6C37 BF4B 8EEF 1A57 1DF5
signature.asc
Description: This is a digitally signed message part.
_______________________________________________ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
