Subject: Re: Certificate life-cycle costs.

From: "Bob Blakley" <[email-masked]>
Date: Fri, 21 May 1999 13:47:44 -0500

Ed,

A quibble here

>But your last phrase is, you may realize, contradicted by the equation I
>presented for the certificate lifetime as the inverse of the sum of the
>inverses of the atttribute lifetimes contained in it -- because the
attributes
>as a whole will very much lower the certificate lifetime even if  each
>attribute and the key have the *same* lifetime.

I think this is not quite correct because of imprecise phrasing.  What I
would have said here is

    ...the attributes as a whole will very much lower the certificate lifetime
even
    if each attribute and the key have the *same* [expected validity
duration].

Normally when I think of "lifetime" I think of a validity interval, and if two
things have the same lifetime, they come into existence at exactly the
same time and cease to exist at exactly the same time.  In this case
there is no independence whatsoever, and the two things should be
thought of as essentially one attribute (hence my caveats about
independence in earlier notes).

In order to lower the *lifetime* of the certificate, what's required is that
attributes expire at *different* times -- as you've pointed out, either
the expected validity duration must be very long for each attribute, or
there must be few independent attributes in order for the certificate
lifetime to be long.

>> So there are two competing trends -- as certificate validity periods
>> increase, the cost of issuance decreases, but the cost of
>> reissuance due to a change in the attributes tends to increase.
>> In addition, as the validity time increases, the cost of carrying
>> a revoked certificate in a CRL also increases.

Dan Geer has a very succint statement of this problem, which he
uses to compare the costs of secret-key and public-key systems.
He observes that in secret-key systems, the costs tend to be concentrated
at the time of issuance, whereas in public-key systems they tend to
be concentrated at the time of validation (e.g. through revocation checks
etc...).  Hence, as he puts it, "you can pay me now or you can pay me later".

>The two competing trends only exist if both certificate issuance and
>certificate validity are CA-centric. If one of them is not, the "loop"
>is at least partially broken -- for example, if certificate validity is not
>CA-centric (as above discussed) then the r-p can apply different decay
>times for each attribute and calculate an instantaneous confidence limit
>for each different  use of the certificate, at different times. Certificate
>validity is then IMO properly centered on the r-p --  who is
>the party at risk *and* knows what the certificate is being used for.
>This allows the r-p to cope with  revoked but partially valid certificates
>("false positives" as mentioned by Blakley as his concern), with
>expired but unrevoked certificates (as I exemplified in time logic),
>and other combinations of validity qualifiers.

The paper some years back by Masse and Fernandes of Chait Amyot
makes Ed's point about risk being borne by the wrong party in "traditional"
PKI trust models and suggests that the relying party's risk has to be
correctly accounted for or else these systems won't work properly.
It's a long paper, but interesting:

    http://www.chait-amyot.ca/docs/pkif.htm

>Alternatively, to center it on the CA will introduce artificial conflicts
>(as you describe above) and increase r-p risks.
>
>> My expectation is that these competing trends are likely to
>> add together, producing a classic bathtub curve that may be quite
>> shallow, indicating that the total cost is relatively insensitive
>> to certificate validity periods.

I don't really think this is likely, at least for certs. with lots of
attributes.

Bob Blakley ([email-masked])
Chief Scientist, Dascom

---

From: Ed Gerck <[email-masked]>
Date: Fri, 21 May 1999 12:26:34 -0700

Bob Blakley wrote:

> >attributes as a whole will very much lower the certificate lifetime even if  each

> I think this is not quite correct because of imprecise phrasing.  What I

Bob:

This is a simple confusion, as that quote of mine was written to Bob
Jueneman, in regard to Bob Jueneman's comments -- not to Bob Blakley
nor in regard to Bob Blakley's comments ;-) Please check the message.

Thus, it will of course NOT apply to what you would have said. Hovewer,
what I wrote is correct -- independently of where it is applied. Let me
prove it:

Suppose, as I said, that each attribute and the key have the same lifetime
"L" -- thus, for N attributes + 1 key, we have:

1/T = 1/L + 1/L + ...+ 1/L +   1/L
          ^^^^^^^^^^^^^^^       ^^
             N attributes               1 key

so that:

1/T = N/L + 1/L  => T = L/(1 + N)

which proves my quote:

 "the attributes as a whole will very much lower the certificate
 lifetime even if  each attribute and the key have the *same*
 lifetime."

In fact,  the attributes as a whole will lower the certificate lifetime in
the ratio of N:1 when compared to the key.

Further, just to use the opportunity,  my quote disproves what has been
called here Steve Kent's Rule of Revocation: "The effective lifetime of
a certificate is inversely proportional to the square of the number of
attributes."

If all lifetimes are equal and all decay times are exponential, then the
correct rule is "The effective lifetime of a certificate is inversely
proportional to the number of attributes." If there are P attributes
(including key) then the lifetime is L/P -- as given above for
P = N +1.

However, if all the decay times are abrupt at the end of their validity,
then the correct rule is: "The effective lifetime of a certificate is
inversely proportional to the least lifetime of any attributes." And, this
follows from the same formula 1/T = 1/T1 + 1/T2 + ... 1/TN,
as I have discussed before.

> independence in earlier notes).

This logic is unfounded. Lifetime is a statistical concept by nature -- since
it pertains to the future and no future is deterministic (it is easy to prove
that if any future attribute is deterministic to a measure To in future time,
then the whole universe must be deterministic to measure To). The
confusion is thus simple -- two things that have the same lifetime
do not have to begin at exactly the same time (think about an atom
emitting light, and all atoms emitting at different times and yet with the
same radiative lifetime for that transition and all independent -- where
one can be in Alpha Centauri and the other in the kitchen lamp.), neither
will they have to or even be expected to end at exactly the same time
since the future is not deterministic.

> attributes expire at *different* times

No, as above. Also, if the attributes have the same lifetime but their
decay rates are non-exponential (eg, a square-function)  then they
will need to be modeled at least as two exponentials (see my former
workout of David's example) and they will cause different reductions
as compared to the pure exponential case (see my example above)..

> -- as you've pointed out, either

This is correct -- but I did not include the word "independent" since
the attributes do not have to be independent for the phrase to apply.

>     http://www.chait-amyot.ca/docs/pkif.htm

Thanks for the reference -- and the comments.

Cheers,

Ed Gerck