Subject: Re: RE: New Extension Proposed: Method Of Authentication

From: Mike Smith <[email-masked]>
Date: Thu, 10 Sep 1998 09:59:21 -0600

Maybe "new" extension is too strong a phrase.  How about defining the policy qulifiers to have some standard" meanings, then:

   reliance limit
   licensure, licensing body
   authentication method
   etc.

If we have standard identifiers, one byte each, provides 0 to 255 specific categories, with say, ten as internet standards.

With initial authentication method, maybe we start with (decimal):
    0 as anonymous, 
    1 as self-authenticated, 
    2 as driver license or government ID card
    3 as passport
    4 as military

then start with combinations including common attributes, such as credit bureau rating as of issuance, etc.

I do understand that, while policy OIDs may be supported some largely deployed systems do not support the policy qualifiers, but the standards do, so why don't we use them to improve our automation needs.  Any time we need to rely on individuals obtaining, reading and being held accountable to a two hundred page contract (CPS), we limit its usability.

Having standard definitions for the most common usages and having these signed as part of the cert by the issuer should facilitate automatic policy acceptance across those domains with multiple policies (if I have accepted all of the Verisign roots, then all of the categories of authentication are accepted.  If each cert has the main characteristics of trust (initial authentication, CA licensure, reliance liits, CPS location/OID, etc.), then I should be able to set my acceptance on user selected criteria, without re-reading the two hundred pages of each of the CAs my company does business with.

Michael

>>> Santosh Chokhani <[email-masked]> 09/09 1:25 PM >>>
The certificate policy is supposed to the represented in the certificate
as an object identifier.  The amendment to X.509 defines how the
applications process that field to determine if a certificate is
acceptable, including certificate policy and associated authentication
mechanism.

X.509 amendment offer a rich set of capabilities in this area in terms
of what goes in a certificate, and how applications perform path
validation.

> -----Original Message-----
> From: Tony Bartoletti [SMTP:[email-masked]] 
> Sent: Wednesday, September 09, 1998 3:12 PM
> To: Santosh Chokhani; 'Phillip M Hallam-Baker'; Mike Smith;
> [email-masked]; [email-masked] 
> Cc: [email-masked] 
> Subject: RE: New Extension Proposed: Method Of Authentication
> 
> At 01:44 PM 9/9/98 -0400, Santosh Chokhani wrote:
> >The subscriber authentication at the various stages (such as initial
> >registration, registration after revocation, revocation request,
> normal
> >rekey, etc.) is supposed to be described in the certificate policy.
> >Thus, the certificate policy asserted points to the authentication
> >method.
> 
> True, but this certainly places a limit upon the degree of automation
> that can be employed in the future, at least until we have software
> that can read a CPS and base decisions upon it.  No time soon.
> 
> Granted, some 20 bits describing authentication method(s) would be
> contentious, but the very exercise would reveal much about where and
> how trust is really anchored, and the degree to which automated agents
> could evolve.
> 
> >There is NO need for another extension.
> 
> Have enough work already? ;)
> 
> ___tony___
> 
> >> -----Original Message-----
> >> From: Phillip M Hallam-Baker [SMTP:[email-masked]] 
> >> Sent: Wednesday, September 09, 1998 1:16 PM
> >> To: Mike Smith; [email-masked]; [email-masked] 
> >> Cc: [email-masked] 
> >> Subject: RE: New Extension Proposed: Method Of Authentication
> >> 
> >> > In using certificates, it is useful to know what form of 
> >> > authentication is used by a CA to identify a new certificate 
> >> > requester.  A certificate extension seems the best place to store
> 
> >> > this information.
> >> 
> >> This sounds to me like a trip into a quagmire. I don't think that
> >> it is possible to charaterize authentication mechanisms usefully
> >> in a set of binary flags.
> >> 
> >> For example two CAs may be requiring presentation of a driving
> >> license for authentication, only one CA may be using a state of
> >> MA license with photo ID and another a UK driving license without
> >> photo ID.
> >> 
> >> Even with documents such as passports there is considerable 
> >> variation between countries in the strictness of their proceedures.
> >> 
> >> Then there are proceedural variations, is the applicant present
> >> in person or were the credentials merely faxed...
> >> 
> >> 
> >> Nor is the mechanism of authentication by itself particularly 
> >> usefull unless there is an evaluation of the reliability of the
> >> party performing it. 
> >> 
> >> Of course one can start to characterise these characteristics
> >> as well but to do so merely throws up yet more information which
> >> might be relevant, factors which become increasingly subjective.
> >> 
> >> 
> >> This is a hard AI problem - establishing a shared vocabulary of
> >> terms which permits exchange of concepts whose semantics are
> >> not embedded in the communication mechanism or indeed any 
> >> mechanism for which a formal description is available.
> >> 
> >>   Phill
> >
> >
> 
> Tony Bartoletti                                             LL
> SPI-NET GURU                                             LL LL
> Computer Security Technology Center                   LL LL LL
> Lawrence Livermore National Lab                       LL LL LL
> PO Box 808, L - 303                                   LL LL LLLLLLLL
> Livermore, CA 94551-9900                              LL LLLLLLLL
> email: [email-masked]   phone: 510-422-3881             LLLLLLLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               !
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               !
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               !
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               !
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               !
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               !

---

From: "Phillip M Hallam-Baker" <[email-masked]>
Date: Thu, 10 Sep 1998 13:48:20 -0400

> If we have standard identifiers, one byte each, provides 0 to 255 
> specific categories, with say, ten as internet standards.
> 

This is heading straight into the quagmire I spoke about...

Decimal numbers is just about the worst approach since it means that 
a central registry has to be kept - yet another task for IANA! and
the arbitrary limit of 255 sounds guaranteed to ensure that the
namespace will quickly become cluttered with ad hoc private 
definitions being used on an 'experimental' basis.

I don't see any value in the taxonomy presented. What is a 'military'
identification method? Is identification by the US army equivalent to
that of the Taleban in Afghanistan?

The drivers license is particularly dubious. My UK drivers license
has no photograph and is valid until sometime after 2020.

Are there CAs who actually want to specify their exact authorization 
processes? Are such processes objectively definable? A commercial
CA does not define authorization procedures for every concievable
document they might accept in their CPS. The first time a US CA
decides on acceptable forms of authentication for a Monaco 
corporation is likely to be when they get a purchase request.

If you want to take the matter further I suggest you write an
Internet Draft and see if the working group chairs want to 
make it a work item.

		Phill