Subject: Cert binding to ?

From: Martin Smith <[email-masked]>
Date: Tue, 02 Mar 1999 22:05:45 -0500

Please excuse the naive and perhaps slightly off-topic intervention, but
I can't shake the feeling that more thought needs to be given to what a
certificate is being bound to.  I have become thoroughly disenchanted
with DNs, or names for that matter, in any namespace scheme.  Consider
the increasing irrelevance of political boundaries; the transience of
employment status, not to mention the rise of self-employment.  After
all, the idea of an heirarchcal namespace seems to have been a device
simply to assure uniqueness under distributed management. What a lot of
baggage for that end!

Leaving aside the naming issue, it seems that the heart of what PKI
should be about (if it is to make the cost/benefit cut) is binding an
assertion or value to a key.  The commonest "assertion" of interest
seems to be identity.  But what is identity?  As a guy named "Smith", I
have to tell you it's not enough to know my name to know who I am or to
find me.  Cutting to the chase: binding to identity comes down to
"binding to the meat".  In the end, identity binding means I anticipate
the need to apply physical compulsion to the object of my interest.  I
want to be able to put him in jail, or ship him out of the country.  The
obvious binding for identity is therefore to a (digitized) physiological
characteristic: fingerprint, retinal scan, DNA.  And by the way:
uniqueness is pretty much taken care of, too.  No problem to add a
handle for user-friendliness.  Mine's Mike Smith and this is my partner,
Jane Doe.

The other bindings of interest are to attributes:  a Swiss account
number; a surety bond; a role (supervisor; treasurer; judge.)  These may
often be attached to a meat binding, but not necessarily.  Why not be
able to open an account anonomously, receive a key for that account, and
present the key to make a withdrawal.  The DEA might care who you are,
but the banker should not. And why should a role be bound to a person?
Why not to a process?

Moving right along, what does this line of thinking imply for the matter
of transitive trust (cross-certificates?)  Most of the time I hear
people (who are actual or prospective CAs/RAs) talking about trusting a
foreign certificate they mean they trust that the other CA has made
reasonably sure the holder is (or recently was) an employee of the other
CA's company.  Generally the name is not meaningful (to the local CA;
perhaps it is to the ultimate relying party if it's an e-mail
correspondence.)  And generally other attributes (like: is the person an
employee, or just a contractor?  Cleared for SECRET?; authorized to make
purchases?) are not known.  To do real business (not supported by a web
of other, non-electronic information) you need the attribute bindings.
Most certainly making inferences from a DN is hazardous.  My only point
here is that for a given transaction, you will typically need a cluster
of bindings, and that those bindings will have different trust paths
leading to CA's that are in charge of (that is, they warrant with
effective recourse for the relying party) different assertions or
values.  In other words, fussing about naming schemes is is distraction.

Martin Smith (or not)

---

From: Tony Bartoletti <[email-masked]>
Date: Wed, 03 Mar 1999 12:11:48 -0800

Martin,

I am in violent agreement.

At foundation, a certificate binds a key to a "bag-of-bytes" (the cert
contents) and any confidence that those bytes represent anything of
meaning (or accuracy) is thus pointed to indirectly (e.g., CPS).

I fear that, as it stands, current commercial PKI efforts are really
designed to obey my "98% rule".  It helps serve to keep the 98% of us
who are honest, honest.  But we need protection from the 2% who are
criminal.  These are the characters who will forge bogus identities,
provide bogus credentials and bogus references, be they passports,
drivers licences, whatever.  All that the current PKI (QCs included)
will serve to do is further legitimize these fake credentials, to our
detriment.

Certifying the 98% who are honest would be of great value, if the
purpose was simply to provide convenient exchange of public keys
in the support of privacy (end-to-end encryption,) but it is of
little value if the goal is end-to-end authentication.  That is
where the 2% become critical.

I think the idea of a global namespace is actually dangerous, and is
more of a threat than an enhancement to security, especially if its
contents (path components) are assumed to carry semantic worth.

They should exist, if at all, as a means to locate the tests by which
authentication or trust can be assessed, and never as the trust in and
of themselves.  The subsequent "tests" should involve parallel paths
and methods, and rely upon coherence in the determination of accuracy.

The current eggs-in-one-basket approach is certainly attractive from
a central-control viewpoint, however.

___tony___

>values.  In other words, fussing about naming schemes is is distraction.

Tony Bartoletti                                             LL
Center for Information Operations and Assurance          LL LL
Lawrence Livermore National Laboratory                LL LL LL
PO Box 808, L - 303                                   LL LL LL
Livermore, CA 94551-9900                              LL LL LLLLLLLL
phone: 925-422-3881   fax: 925-423-8002               LL LLLLLLLL
email: [email-masked]                                   LLLLLLLL

---

From: Stephen Kent <[email-masked]>
Date: Wed, 3 Mar 1999 18:36:23 -0500

Martin,

Identities often are not universal, so the almost philosophical issues you
raise need noty apply. Identities asserted in well-defined contexts are
very useful, and characteristic of many of the relationships we experience
in the physical world.  If certs merely allow us to recreate these
relationships in cyberspace, they will be of great value.

For example, an identity can be a name and account number with a merchant,
a name and employee number, ...   Many certs will be used in transactions
where one does not require the sort of extreme binding to a physical
instance of a person that you cite.  Also note that, in many instances, the
globally unique IDs that one can imagine have the property that they are
not meaningful to the many individuals and institutions which whom we
interact.  So, don't get hung up on the notion of binding DNA,
fingerprints, et.c into certs.

Finally, cross certs are not about transitive trust, if properly done.  A
cross cert with a NameConstraints extsnsion will generally PREVENT, not
enable, transitive cert validation.  Cross certs are a great means of
achieving pairwise bindings in which one CA recognizes the authority of
anther CA for a given name space.

Steve

---

From: Martin Smith <[email-masked]>
Date: Wed, 03 Mar 1999 21:33:13 -0500

Well, OK.  If PKI is about achieving the same level of trust we enjoy in
meatspace, then maybe a lot of rigor is too much. A lot of money is spent in
restaurants where you hand your credit card to a waiter who disappears, or at
catalog stores where you give a card number to someone over the phone.   The
weakness of that argument, however, is that PKI is liable to be pretty
expensive (who's paying all those new CAs and RAs?) so if it doesn't do
something significantly better than SSL with challenge/response (which is how
many of us do securities trades) , why bother????  (Apart from the fun of
really neat technology.)  <g>

Martin

PS--My attitude comes from a couple of years running an "X.400 users group."

> relationships in cyberspace, they will be of great value.

snip