Trust

As a quick recap:

1. Authentication i.e. verifying that someone has the proper credentials to enter the system can be done via 
1. Passwords
2. Public key encryption. The gatekeeper will request from the person some agreed upon message that will be encrypted with the private key, and only the public key can decrypt it. This way, the gatekeeper knows that the person has passed the truth-test for the public-key/private-key mapping. Should the gatekeeper "trust" this person ? This is a separate issue and this is handled via "Certificates"

Imagine the following scenario. You meet someone new and they need proof that you have the credentials you claim you do. You can say orally that you have a M.S. Degree. Is that good enough ? How can they "trust" you ? To make them trust you, you will present them with some certificate signed by someone THEY trust. e.g. you can show the university certificate. They can then call up the university and find out if you have indeed passed. In PKI, the certificate presented will help the new party to verify that. However, do they "trust" the university ? This is another separate question. In case of Digital Certificates, the following logic applies.

1. The CA has confirmed that the public-key that shows up in the certificate is "trustworthy" and to say this, CA will sign this public key with its own private key. What if CA has trusted some fake machine ? This then becomes the CA's fault. The question arises, how can a CA trust someone.
2. Once the user gets a certificate signed by a CA it trusts, the end-user can accept that it is talking to someone trustworthy.  

So, as i see it, "Trust" itself seems to rely on out-of-band things like "reputation", "group-think" and other metrics. This is one frequently cited paper. Trust thus, is a "chain". If any one in the chain is a fake, the whole trust chain breaks. Thus, one needs constant checks and confirmations that someone is trustworthy.

In other words, the learning is that "trust" has to be earned, and further that trust has to be retained and maintained. Also one must note that "trust" is a human emotion, and we create all these systems because we as humans want to get our work done by trustworthy sources i.e. sources that will help solve our problems and satisfy our desires.

In this sense, trust is a engineering problem.