Subject: RE: Attribute used to store cached certificate chains?

From: "Tammy Carter" <[email-masked]>
Date: Wed, 03 Feb 1999 14:00:39 -0700

Steve,

Generally speaking, information which is stored in a directory is accessible only to those people who are granted explicit access rights.  And, by default, only the user would be given rights to his encrypted private key stored on his own object.  Thus, the user would have to specifically gave someone else rights to access his private key.  

However, those administrators with direct access to the directory database wherein my object resides could give themselves rights to my private key.  Or copy it for an off-line attack on the encryption.  Or even change it.  When my encrypted private key is stored in the directory, it is vulnerable to anyone who can get to a server which holds a copy of my object.  As we are fond of saying here - - Once someone has physical access to the server, all bets are off.  

BUT....  That's true about any information which is stored in a directory.  Not just about my private key.  From a company's perspective, there are far worse things that someone can do with physical access to a server than to pose as one of their employees.  So, a company would (hopefully) screen people a bit before giving them the keys to the kingdom.

It certainly seems reasonable for me to store the encrypted private key that I use for business purposes in the directory that my company maintains.  But, would I store the encrypted private key that I use for my on-line banking there?  I think that I'd have to weigh the pros and cons.  On one hand, if I store it in the directory, I can use it even if I don't have my smart card and I never have to worry about losing it.  On the negative side, some administrators could, potentially, pose as me.  If I stored it in a smart card, I have control over it.  But, how well do I guard my wallet against theft?  How often do I lose it?  Anyone who finds/steals my smart card could break the PIN number and pose as me.  

The choice seems to be about how much I trust myself as opposed to the company whose directory I'm using.  There's no right answer here.  Both have their vulnerabilities.  Both have their shortcomings.  It all seems to boil down to:  Who do you trust?  and   What kind of availability do you need?

Tammy Green Carter

>>> Stephen Kent <[email-masked]> 2-1-99 3:14:41 PM >>>
Tammy,

>You asked about storing the private key.  Currently, Novell's PKI solution
>encrypts the private key and stores it in the user's object.  The private
>key is encrypted with a partition specific key such that each server
>holding a replica of the partition in which the user's object resides can
>decrypt the private key.  We use ACLs provided by the directory (NDS in
>our case), to keep unauthorized people from reading the private key.  For
>those users who don't trust the directory or their administrators, we are
>working on a solution which will store the private key on a smart card.
>When smart cards come along, the obvious place to store the chain is on
>the smart card, eliminating these issues altogether.

I'm surprized by the description above, if I understand it.  Why is the
private key for a user accessible to anyone but the user?  Letting
directories have access to that key seems like a very a serious security
problem.  Even when smart cards are more widely used, their storage is
limited, so you may find it appropriate to keep private keys and certs, as
well as cert chains, in a directory object, on a per user basis, so that
this info ca  be downloaded and the appropriate private keys moved into the
user's smart card, as needed.

Steve

---

From: Tony Bartoletti <[email-masked]>
Date: Wed, 03 Feb 1999 19:06:54 -0800

>Steve,

[snip]

>The choice seems to be about how much I trust myself as opposed to the company whose directory I'm using.  There's no right answer here.  Both have their vulnerabilities.  Both have their shortcomin…

And is it wise to design into infrastructure a "favored" paradigm, when it is
guaranteed to disaffect that half of the community who want to do it the other way?

____tony____

Tony Bartoletti                                             LL
SPI-NET GURU                                             LL LL
Computer Security Technology Center                   LL LL LL
Lawrence Livermore National Lab                       LL LL LL
PO Box 808, L - 303                                   LL LL LLLLLLLL
Livermore, CA 94551-9900                              LL LLLLLLLL
email: [email-masked]   phone: 925-422-3881             LLLLLLLL