Subject: RE: Location and Identification

From: Andrew Probert <[email-masked]>
Date: Mon, 22 Mar 1999 08:08:24 +1000

In my opinion, some directories can be made as secure as any other database
technology e.g. SQL.  Directories as a form of OO database, with X.500
access controls actually allow protection over trees, subtrees, object types
even down to attributes based upon the name you choose to login, including
strong auth login as well.

I think the discussion at the moment is philisophically about whether to put
some of this biometrics stuff online at all.

In our country, the push for a national identity card was totally sunk upon
issues of privacy.  We don't even allow so much as the US social security
card style.  Also, the only people with fingerprint databases are the police
and only for convicted felons.  

I believe whilst it is technically feasible to putsome of this biometrics
online, it is not commercially feasible or socially acceptable.

A more natural approach is to consider that most computer sytems have access
control mechansms.  RACF, ACF2, Unix file permissions, ACLs etc.  These are
all closed and proprietary mechansisms.  Attribute Certficates can be used
to provide open mechanisms that are analogous, for distributed systems.  I
think personal identity and access to servers that allow privilige are
technically and socially acceptable.

Andew Probert
Rotek Consulting   http://www.rotek.com.au
a Division of Secure Network Solutions
Tel  +61 3 9690 8877
Fax +61 3 9690 8171

> -----Original Message-----
> From:	Bob Jueneman [SMTP:[email-masked]]
> Sent:	Saturday, March 20, 1999 6:36 AM
> To:	[email-masked]
> Cc:	[email-masked]
> Subject:	Location and Identification
> 
> I think Tony has some interesting points, so I'll take him up on 
> forwarding them to the list, then respond.
> 
> Bob
> 
> >>> Tony Bartoletti <[email-masked]> 03/18/99 05:47PM >>>
> Bob,
> 
> I am a bit reticent to jump into the threads with this, but I offer
> it to you to use as you wish (forward, edit, consider, whatever.)
> My thoughts here are in response to several recent threads.
>  
> I don't pretend to know the intimate details of DNs, AltNames, etc.,
> (collectively "Name-Like-Things") and the precise handling expected
> of them by X.509-conforming software.  Nor am I expert at the varied
> contents (keys, et al) that may be bound into the certificates,
> (collectively, "Ident-Challenge-Data").
> 
> I see from these discussions at least two broad and (in my ideal)
> orthogonal dimensions that people intend for them to serve:
> 
> 1.  Location (of individual/cert or their issuer)
> 
>     Ranging from Global-Public-Location to Proprietary-Location
> 
> 2.  Secured Identification (of located item.  "Ident-Challenge-Data")
> 
>     Ranging from Public/Private Keys to Biometric Data.
> 
> I think it is useful to consider this (simplified) "quad-chart"
> and characterize various schemes/applications accordingly:
> 
>   FUNCTION:    |  Object Location         | Object Identification
>   METHOD:      |  (via Name-Like-Thing)   | (via Challenge-Data)
>   ---------------------------------------------------------------
>   (subclass)   |  Global Public Locator   | Keys/Issuer-Keys
>   ---------------------------------------------------------------
>   (subclass)   |  Proprietary Locator     | Biometric Data/Hash
>   ---------------------------------------------------------------
> 
> Note:  I do not intend for these "rows" to indicate correspondence.
> That is, one could deploy a system where a "Proprietary Locator" is
> used to retrieve "Keys/Issuer-Keys" Challenge-Data, (basically, the
> current situation with key-certificates) or (God Forbid) a system
> where a "Global Public Locator" can retrieve an individual's
> Biometric Challenge Data.
> 
> Furthermore, in each possible case, one can imagine a protocol
> that either does or does not require the "data-owner" to cooperate
> in the final step of identification (say, you believe you have
> located someones challenge-data, but can only see a piece of it
> large enough to query them to release the remainder, and can
> then proceed with a full challenge if they concur.)
> 
> This is how the telephone white-pages work.  If I find (say) three
> "Bob Jueneman" I can call each one.  If I say "Are you the Bob that
> posts to the PKIX list," you can either reply with additional
> confirming data, or say "Sorry, this is Jueneman's Plumbing Supplies,
> we only carry PVC, no 'PKIX'" just to avoid me.  
> 
> If I may characterize the discussions of late, I see some threads
> hoping to elevate (?) Proprietary Locators to Global Public Locators,
> (Simon says, "Lets build the X.500 directory of Babel") and others
> to extend certified content from Keys to Biometrics, for instance.
> 
> Worse, I also see a blurring of the functions themselves, to wit,
> "Let a secure directory hold established name-hierarchies that map
> precisely to the material world, thus Existence-In-Directory
> implies Identification, (delete one challenge-response.)"
>        
> As sexy and convenient as it may seem to overload these functions,
> especially Location with Identification, such a scheme would be
> both unstable and dangerous (the ultimate bad combination).
> 
> When someone says "We can make the directories secure" I cringe.
> How secure?  For what?
> 
> The public telephone white-pages are secure enough for their purpose;
> if a hacker or insider makes malicious modifications, it is just an
> inconvenience for the most part.  If a directory holding my keys
> is compromised, more hassle, but I can revoke and be re-issued.
> 
> I don't know if nature allows a directory secure enough to house
> my biometric data, unless it is purely encrypted blobs to the
> root directory operators, and I have secure control of the keys.
> 
> A Final Thought:  I am beginning to wonder if I should start a
> global movement to have everyone capture all of their biometric
> data (fingerprints, retinals, DNA sequences, etc) and publish
> them in a giant, open public repository.  Would this not serve
> make such data effectively worthless?  The only way this data
> can be used to effectively "impersonate" me, is if there is a
> reasonable assumption on the part of the relying party that
> such information is uniquely held.  Destroy this assumption,
> and the ability to impersonate disappears, no?
> 
> ___tony___
> 
> 
>  
> 
> Tony Bartoletti                                             LL
> Center for Information Operations and Assurance          LL LL
> Lawrence Livermore National Laboratory                LL LL LL
> PO Box 808, L - 303                                   LL LL LL
> Livermore, CA 94551-9900                              LL LL LLLLLLLL
> phone: 925-422-3881   fax: 925-423-8002               LL LLLLLLLL
> email: [email-masked]                                   LLLLLLLL

---

From: Tony Bartoletti <[email-masked]>
Date: Mon, 22 Mar 1999 10:33:42 -0800

>strong auth login as well.

Yes, it can be made just as secure as any other database technology.

The maintenance personnel who format and replace those disks when they
go bad may be rather difficult to secure in perpetuity, however.  And
once the data "gets out", as many have observed, it cannot be "revoked".

Public once, public forever.

>and only for convicted felons.  

We can change that.  It is in the power of each individual to publish
their biometrics, if they so desire.

>online, it is not commercially feasible or socially acceptable.

Many things not considered "socially acceptable" thrive on the internet.

>technically and socially acceptable.

No argument there.

___tony___

Tony Bartoletti                                             LL