Mark Handley makes that very point on page 3 of his paper here (sorry about the PDF): http://www.cs.ucl.ac.uk/staff/m.handley/slides/tcpcrypt.pdf http://www.cs

Mark Handley makes that very point on page 3 of his paper here (sorry about the PDF): http://www.cs.ucl.ac.uk/staff/m.handley/slides/tcpcrypt.pdf http://www.cs.ucl.ac.uk/staff/m.handley/slides/tcpcrypt.pdf "Encryption without authentication is like meeting a stranger in a dark alley." However, on subsequent pages he writes about ways to do authentication over tcpcrypt using the session ID, including signing it with an SSL certificate or using HMAC with shared passwords. As he says, "many different authentication schemes [are] enabled by the session ID concept." The tcpcrypt.org site itself says "Tcpcrypt abstracts away authentication, allowing any mechanism to be used, whether PKI, passwords, or something else." Perhaps these mechanisms can help us gradually avoid the problems with both central authority schemes and key continuity schemes, but I haven't thought about it or researched it enough yet to know. I have a love-hate relationship with SSL, and when I hear about hijacked CAs and even see root certs in the name the various governments in Firefox, I get the chills. But I can appreciate SSL's strengths. On the other hand, I really like SSH's key continuity, but I also appreciate some of its difficulties on the web. As an experiment, I recently deleted all CAs from Firefox and started approving web sites by exception one by one. Does anyone here have a good handle on how tcpcrypt's "abstracted" authentication schemes might thread that needle, simultaneously avoiding the difficulties and pitfalls in both camps?