News.  Information.  Education.  

Ask PKIForum.com is an interview feature where you have the chance to ask the experts questions of your own.

Is there someone that you would like to see interviewed? Make a suggestion! Please send an e-mail message to

You can to our low-volume mailing list for e-mail notices of site news, contests and more.

To subscribe to our newsletter, please send an e-mail message to with the subject line SUBSCRIBE.

PKIForum.com is an independent news, information and education organization focused on public key infrastructure (PKI).

To contact PKIForum.com, please send an email message to

If you are interested in sponsorship opportunities at PKIForum.com, please send an email message to

Thank you for visiting PKIForum.com! We hope to see you again soon.

 EXCLUSIVE INTERVIEW: PART TWO

<<< Page 1

PKIForum.com: One of the recent certificate problems that VeriSign had was with the Microsoft code-signing certificates. How well do you think that incident was handled and how can those kinds of problems be avoided or fixed?

Spafford: Well that's one of the problems with certificate authorities -- how can you trust them? Really, you don't have lot of choices right now; it's basically VeriSign. But what are the rules that they use for assigning certificates, how much trust do you have in those and what recourse [do you have] if it goes wrong?

The Microsoft incident exposed a number of concerns, one of which is the whole revocation problem. A lot of people may end up accepting certificates over their lifetime -- not necessarily those [ones], but [any] certificates -- without knowing where to go to get revocation lists and without having them available that they can access.

[The Microsoft-Verisign incident] also serves as a pointer to some of the problems with the Authenticode approach that Microsoft has adopted, which is, basically, the code is allowed to run on your machine and do whatever it's going to do if you let it. And the recourse you have is you have an idea of whose certificate it was that signed it. But it's not that difficult to get certificates -- not necessarily with Microsoft on them, but with somebody's name on them -- and that gets back to, again, identity is not the same as trust.

So, knowing the name of someone doesn't necessarily give them -- shouldn't give them confidence.

"Technologists don't understand the problems that go with their solutions "

PKIForum.com: That's one of the problems. There are also cost and complexity issues with certificates and PKI.

Spafford: Yes.

PKIForum.com: You've talked about that already. Do you see the people adopting it without those problems being resolved at any point? Do you see widespread adoption of it?

Spafford: I don't think so. As I said, I see it happening within enclaves -- within corporations, within agencies.

It has a lot of advocates, it has a lot of people who have devoted time to it, but I think there's a lesson to be learned from digital anonymous cash.

You'd asked for something that was premature, by the way. Well, I think that was premature and it's burned many investors and many people who said, "Gee, I'm not too keen on using that." Some great ideas, some wonderful mathematics and technology behind it, but the whole usage and public acceptance and interface wasn't thought out carefully. And I think that's the same of what's happening here.

The technologists are the ones that are saying, "Gee, this is great! Look at all the things we can solve with it!" and they're right, but they don't understand all the problems that go with those solutions.

As a generalization, that's undoubtedly unfair to the people working in the area. But in general, what I've seen about people talking about PKI and cryptographic solutions in general, they haven't thought through the political, social and economic issues that also go with that.

"We should be much more cautious about embracing technology "

next >>>

 Copyright © PKIForum.com^TM 1999-2003. All Rights Reserved.  The PKIForum.com logo, "PKIForum.com", "PKI Forum.com" and "PKI Forum" are trademarks of PKIForum.com and its proprietors.