Subject: SEIS: RE: Certificates, Directories, and Distinguished Names

From: "Bob Jueneman" <[email-masked]>
Date: Wed, 07 Apr 1999 14:10:52 -0600

Tony is right on with respect to the concerns that some individuals 
will have with respect to technology.  When ATMs and direct deposit
technology first emerged, it was the accountants and finance managers
within some companies that were the most doubting Thomas's.

Certainly as we get closer to Y2K, there are a fairly sizeable number
of people who are buying gold and platinum double eagles rather
than trusting a fractional deposit banking system, and who can say
at this time whether they are right or wrong.

I spend a fairly significant amount of my time engaging with various 
attorneys and legislators and debating the relative risk/benefit
of PKI in general, and the risk of a compromise of Grandma's 
private key in particular, and I can testify that the is a large portion 
of the highly influential public that is not yet sold.

Of course from my perspective they are straining at gnats and 
swallowing camels -- they are concerned that a virus could 
somehow compromise a private key, but at the same time they 
willing allow a typed document on a letterhead to serve as a legally 
binding signature, not to mention a faxed signature or simply a fax
with an automatically inserted origination code on the top of the 
page.

They will undoubtedly come around -- I remember with some shock 
the first time I went to a legal meeting and all of the attorneys had
laptops and there were not legal pads in sight.

But until that day comes, they are the folks that are writing the laws, 
not us, much as I try to play gadfly in that community.

Bob

>--- Message on the SEIS mailing list ([email-masked])
>
>Just a General Observation:
>
>The "pack-it-in-the-cert"/"pack-it-in-a-directory" debate seems to
>parallel, in some ways, the recent thread on Anders' "CyberPhone"
>approach to outsourcing one's private-key handling.
>
>And "convenience," indeed, can only be ignored at one's peril (in
>a business model, at least:)
>
>Over all of this, I cannot help but be reminded of those who lived
>through the Great Depression, and to this day feel uncomfortable
>placing their money in banks.  They will insist upon dealing in
>"cash", the kind they can stuff under their mattress, or bury in
>a steel box in the backyard.  Foolish at it may seem to most, they
>insist upon being the final arbiters of their security/destiny,
>however ill-equipped to the task they may be.
>
>No amount of argument that, statistically, their money would be
>safer in a bank, or as bits-on-a-disk, will dissuade them.
>(And who knows, in the long run, if they will be wrong or right?)
>
>Must we promote a world so hostile to these individualists (they
>are many, if not majority) that they become shut-out of the future
>benefits that PKIs may afford?
>
>Is this concern not a silent undercurrent to many of these debates?
>
>___tony___
>
>
>
>Tony Bartoletti                                             LL
>Center for Information Operations and Assurance          LL LL
>Lawrence Livermore National Laboratory                LL LL LL
>PO Box 808, L - 303                                   LL LL LL
>Livermore, CA 94551-9900                              LL LL LLLLLLLL
>phone: 925-422-3881   fax: 925-423-8002               LL LLLLLLLL
>email: [email-masked]                                   LLLLLLLL
>
>
>----------------- SEIS mailing list ([email-masked])
>Info about this list: http://www.nc-forum.com/seis 
>SEIS Contact: [email-masked] 
>

---

From: Alan Lloyd <[email-masked]>
Date: Thu, 8 Apr 1999 13:31:01 +1000

Yes its is probably best to teminate this discusion - simply because,
and as usual, one asks the harder questions openly eg. Cert Subject and
Issuer Alt names why, when, where?  - and DNS names in certs and the
validation issues.. and the rekey issues (for the real world) because of
organisational and personnel churn (if email addresses are used).. And I
(and others) follow this up with sound experience in dealing with
distributed information engineering (eg directories), validation and
revokation issues and also major global applications that wish to use
PKI functionality ...

what do you get back? not a lot.

One aspect of inventing standards is that should serve at least five
years of development and product introduction into operational  business
systems.

regards alan

> -----Original Message-----
> From:	Stephen Kent 
> Sent:	Thursday, April 08, 1999 10:41 AM
> To:	Alan Lloyd
> Cc:	[email-masked]; [email-masked]
> Subject:	SEIS:  RE: Certificates, Directories, and Distinguished
> Names
> 
> Alan,
> We seem to be making no progress wrt this discussion, like many of our
> previous debates.  Let save a few virtual trees and call it quits.
> 
> Steve
> 
>

---

From: Alan Lloyd <[email-masked]>
Date: Thu, 29 Apr 1999 08:56:25 +1000

Moshe,

I understand your comment and commercially we deal with that  - but with
ASN.1 and encoding schemes - if the implementation is not robust or has
good exit strategies then protocol/syntax decoding of unknown inputs can
cause serious fails.
For instance I think a good test of an LDAP server is to log in without
name or password, construct an entry in the client say of 10megabytes
and then just add it to the server (create the entry).. in some cases
the protocol processing code, the ASN.1 decode  or the object processors
(even before you get to access control checks, etc ) in the server will
explode.
My point is though that it sometime easier to implement a full range of
attributes, specifically naming  and string attribute types, than to
have exits which may fail or if they get called - just means that that
the attributes have to be implemented anyway.

regards alan

> From:	Moshe Litvin 
> Sent:	Tuesday, April 27, 1999 6:29 PM
> To:	Alan Lloyd
> Cc:	[email-masked]
> Subject:	Re: SEIS: Re: Certificates, Directories, and
> Distinguished Names
> 
> 
> 
> Alan Lloyd wrote:
> 
> <snip>
> 
> >
> >         Let me highlight some issues with 2459.
> 
> <snip>
> 
> >         3. Section 4.1.2.4  -last para page 19 - " The Telexstring
> and
> > Universal string ... Certificate Users SHOULD" .. this magic word
> > "Should"..
> >         There is no sure way of knowing what encoding is being rxd
> by an
> > implementation and if they do not decode strings correctly the
> > implementations will fail or crash. If building a commercial robust
> PKIX
> > implementation - one would expect a profile - if there are known
> uses of
> > the scheme out there, to say all recieving certificate using systems
> > must support this. ie a profile must dictate robustness to current
> > implementations - not leave an implementor with a guess and bugs.
> >
> 
> I disagree. Security software should always check its inputs carefully
> (assuming it may be hostile). No need to for special treatment here in
> regards for crashes.
> 
> regards,
> 
>     Moshe
>  << File: Card for Moshe Litvin >>