Include info from "10 risks on PKIs", ellison/schneier. [TODO]
Security of a system is equal to the "security" of it's weakest link. People don't usually see all the links. People don't count both network/human factors. From each discipline, they stress the factor they have familiarity.
Should we have CA AND RA? Network security says it's safer, layered security, hierarchy, etc. Theoretic ppl says no much difference, or it is worse to have two different. Standards (PKIX) propose to use an RA, although do not oblige.
Watch the interactions of your system to secure it.
Human factor is greatly ignored. CS disciplines ignore the study as too law-bound, non-CS disciplines don't have the whole picture. Is it important to study this one? Can traditional methods solve the problem?
Who has the private key? It's stored in a security module, right? If it fails, what happens? Have a backup? To store in different locations (geographically)? There was a recent relevant discussion on those two MS keys.
We cannot draw the whole picture at once. We need to do it step by step. Open-Source reference implementations, widely/wildly used can show the way. Need to test and analyse feedback.
We need SSO software, openproject has PAM draft and it looks nice. There is a "killer" applicance from Samba developers that does SSO?
CDSA version 2 is very nice and standardised. openproject tambien. Bull.fr has the responsibility for the Linux port or implementation, along with Intel. Results promised in September 2000.
In the Department of Defense Appropriations Bill of the US for the year 2001 there is a description of the budget allocations. The document mentions the budget for the usage of PKIs and the recommendation is for $18.6m US dollars. It is important to notice that the description of the expense is Information Assurance. The document is available from the House Reports Online via GPO Access link as report number 106-644.