Although SDSI does not provide an automatic way for a principal to prevent her trust from being infinitely extended, it does make trust relationships explicit and auditable, so a principal can tell if her trust has been misplaced. Certificate validation method SDSI operates in a completely online environment. Certificate revocation method SDSI s online orientation allows principals to revoke certificates instantaneously, and the reconfirmation periods place a clear upper bound on how long revocation information will take to propagate. Identity vs. credential certificates SDSI provides both identity and, through its group mechanism, credential certificates. SDSI s linked local name spaces can dilute the strength of authentication as name space chains grow.
Longer chains require a greater number of trustworthy principals.
SDSI s global name space mechanism allows for strong authentication provided there are a small number of distinguished global roots. Once that is achieved, all other information can be obtained in-band. Anonymity SDSI can provide anonymity for its principals at the expense of authentication strength. To support strong authentication, a principal must either provide a global name for itself, or be well-known to the other principals he deals with. In particular, one of the SPKI s requirements is to support, where possible, the SDSI local name space mechanism.