In an a priori anonymous digitized world, notions such as authenticity and trust are of paramount importance. Unfortunately, the exact meaning of such key terms has never been consistently defined, and they are often used in an ambiguous way. In this paper, we introduce a new model for representing these fundamental notions in the context of rating systems in e-business applications as well as for public-key certification. When applied to existing systems, its goal is to shed light on the implicit assumptions actually made by the participants. As an example, we show that for the rating system used in eBay, there are a number of such implicit assumptions on which the drawn conclusions depend. A second example is PGP, where it turns out that the meaning of the (syntactically well-defined) certificates is not entirely clear.

Public-key certification is of crucial importance for advancing the global information infrastructure, yet it suffers from certain ambiguities and lack of understanding and precision. This paper suggests a few steps toward basing public-key certification and public-key infrastructures on firmer theoretical key. In particular, we investigate the notion of binding a public to an entity. We propose a calculus for deriving conclusions from a given entity Alice's (for instance, a judge's) view consisting of evidence and inference rules valid in Alice's world. The evidence consists of statements made by public keys (e.g., certificates, authorizations, or recommendations), statements made physically toward Alice by other entities, and trust assumptions. Conclusions are about who says a statement, who owns or is committed to a public key, and who transfers a right or authorization to another entity, and are derived by applying the inference rules.