Ian Grigg Security Architect, Systemics Inc

1
Ian GriggSecurity Architect, Systemics Inc

• TECH two major techs and architectures
• X.509 with Certificate Authority model
• RFC 2440 (OpenPGP) with web-of-trust model
• Identity is not the Application.
• Do we want Identity or Authorisation?
• Identity is poor fit to application needs
• If only I could do this
• Costs are high, benefits are elusive
• Not conducive to voluntary rollout

2
Ian Grigg Security Architect, Systemics Inc

• What can we do with what weve got?
• Redirect from Identity ?Authorisation
• Use self-signing for cost reduction
• Use branding to address security issues
• Use RFC2440 for more flexibility