Subject: Re: Attribute certificate lifetimes: still way too much math

From: "David P. Kemp" <[email-masked]>
Date: Tue, 18 May 1999 16:35:35 -0400 (EDT)

> From: Ed Gerck <[email-masked]>
>
> REPLY:  Try equation (1) : "The inverse of the certificate lifetime is equal
> to the sum of the inverses of each effective attribute lifetime".

That is true as long as your assumption holds.  But if the assumption
does not hold, the equation fails.  Garbage in, garbage out.

For a counterexample, assume that a company has a policy of reassigning
its employees every three years.  A certificate might have the following
collection of attributes:

   eye color (lifetime = 72 years)
   department (lifetime = 3 years)
   telephone  (lifetime = 3 years)
   manager    (lifetime = 3 years)
   
Assume that everyone is happy at this company, so that turnover is very
low (<1%) and unexpected changes in assignment are rare.  I contend that
the expected lifetime of this certificate is closer to the minimum attribute
lifetime (3 years) than the value indicated by your formula
(1/3+1/3+1/3+1/72 = .986 years).

The probability that the phone number remains valid does not decay
exponentially with time, it remains nearly constant (perhaps decaying
slightly) for three years, at which point it falls abruptly to near zero.

You could argue that the three attributes above are correlated and should
be lumped together, but I could come up with a counterexample with three
non-correlated step-functions that would confound the use of a simple,
generally applicable formula.

The content of my message to Bob was 86% a failed attempt at humor, and
14% a general observation that correct statistical calculations (and I
agree that your math and his is correct) will not help if the model does
not fit the data.

---

From: Ed Gerck <[email-masked]>
Date: Tue, 18 May 1999 19:01:53 -0700

> does not hold, the equation fails.  Garbage in, garbage out.

My assumption is very unassuming ;-)  -- it is simply that any attribute validity
in a X.509/PKIX cert is an non-increasing function of time. If you find a
X.509/PKIX attribute that increases its validity with time then you have found
an exception where my formula (and Blackley's, buy extension) is not valid.

That exception would be trust, of course, since trust can indeed increase with time
and increase reliance, thus validity (so we hope, usually).   Trust is earned and can
benefit from learning. But since trust is not contained in a X.509/PKIX
certificate's attributes, then this exception does not apply where my formula applies
here -- for PKIX certificates.

> (1/3+1/3+1/3+1/72 = .986 years).

No. Please realize that you are simply applying the formula and then denying
its very parameters that *you* defined -- since nowhere above you say
what you assume below in order to "contend" that the certificate lifetime
is close to 3 years. Indeed,  garbage in, garbage out -- one must be
consistent in problem formulation. What I mean is that it is OK for you
to assume that the phone number remains valid for three years with an
almost flat validity and then abruptly falls to zero -- but why in heavens
don't you use *this* information in the formula above?

Please, see below how this can be used -- and, indeed, you MUST if this is
what you rely on (please see reference [1] of my posting). Otherwise, the
problem is just being inconsistently formulated -- not inconsistently solved.

> slightly) for three years, at which point it falls abruptly to near zero.

If you say so ;-) -- but still my model applies. Let me explain.

As you say -- but this simply means that you need two lifetimes (as I called
them, two sub-attributes). One lifetime is very long and just leads to that
slight decay you mention for three years. Then, another lifetime is triggered
by a delayed sub-attribute, but this lifetime is very short. But, you may ask, how
can I take delayed sub-attributes into account? Simple, by considering the
certitficate lifetime to be given by a piecewise function. It does NOT include
the short-lifetime delayed attribute until its maturation period (that you say is
3 years), and then adds it as 1/Ts. But, since Ts is small, 1/Ts is large and its
effect on the certificate lifetime T is large. So, a small Ts strongly
*decreases*  certificate lifetime T, since 1/T = (1/T1 + ..1/Tm) + 1/Ts and
(1/T1 + ...+ 1/Tm) is constant. Clear?

> generally applicable formula.

No, that is not what I argued :-)  I simply argue that if you withhold information
when you apply the formula then you can't expect the formula to represent what
you don't say.

> agree that your math and his is correct) will not help if the model does

The model I presented can fit any cert data (as above, for your example) as
long as the attributes' validities are monotonically decreasing functions of
time -- which is a very general assumption. The difficulty I see with your
example was that your later data did not fit the problem you initially described
-- not that the model could not fit the data once that data was decloaked ;-)

Your example was though excellent in that it allowed this to be discussed and
exemplified -- and, even though sub-attributes and their need as well as why
N >= M are mentioned several times in my previous posting, the issue was not
exemplified.

One application of a similar theory is in fluorescent studies of excited atoms,
where a particular forbidden (ie, very long lifetime) radiative transition lifetime
is changed by collisions to a strongly allowed (ie, very short lifetime) exciplex
emission and gives rise to a very large but delayed emission effect. Believe me,
that problem is much more complicated than certitficate attribute lifetimes but
I solved it 17 years ago with the same method. You can check it at:

E. Gerck and E. Fill, "1.3 u m excimer emission with I(2p1/2)", Proc.  XII Int. Quantum Electron. Conf.-Munich, Appl. Phys. B, vol. B 28, p. 285, 1982.

E. Gerck and E. Fill, "Infrarot Fluoreszenz von Jod-Exzimeren" in Verhandlungen DPG (VI) 17, p. 448, Germany, 1982.

E. Gerck and E. Fill, "XeI excimer emission at 1.3 um", Opt. Lett, vol. 7, p. 25, 1982.

 E. Gerck, "Collisional enhancing of the I(2p ½) infrared emission by parent molecules CF3I, C2F5I, i-C3F7I and n-C3F7I", Opt. Commun., vol 4l, p. 102, 1982.

E. Gerck, "Quantenausbeute von 1(2p ½) von Jodlasermedien bei 308 und 248 nm", in Verhandlungen DPG (VI) 18, p. 438, Germany, 1983.

E. Gerck. "Spektral aufgeloeste Emission von I(2p ½) - Puffergas-Exziplexen bei 1,3um", in Verhandlungen DPG (VI) 18. p. 447, Germany, 1983.

E. Gerck, "Quantum yields of I(2p ½) for CF3I, C2F5I, i-C3F7I, n-C3F7I, n-C6F13I and 1,2-C2F4I2 at 308 nm and 248 nm", J. Chem. Phys., vol. 79, p. 311, 1983.

Cheers,

Ed Gerck
______________________________________________________________________
Dr.rer.nat. E. Gerck                                 [email-masked]
  ---  Meta-Certificate Group member -- http://www.mcg.org.br  ---

---

From: Ed Gerck <[email-masked]>
Date: Tue, 18 May 1999 22:06:37 -0700

List:

I received some private requests to work out the example provided
by David Kemp, using sub-attributes to calculate the certificate lifetime.

The example, regrouped for its parts, is:

>Assume that a company has a policy of reassigning its employees
> every three years.  A certificate might have the following
> low (<1%) and unexpected changes in assignment are rare.
...
> slightly) for three years, at which point it falls abruptly to near zero.

The lifetime calculation has the following steps:

1. Modelling of effective attributes

1.1 eye color (lifetime = 72 years), single exponential decay
      Te = 1/72

1.2 department (lifetime = 3 years), single exponential decay
       Td = 1/3

1.3 telephone  (lifetime = 3 years), nearly constant for 3 years, then falls
      abruptly to zero. The "telephone" attribute has then two sub-attributes,
      ts and tf:

ts. a very slow decay for three years, which corresponds to a very large
    lifetime, so that Tts >> 1 and 1/Tts ~ 0

tf. a very fast decay if the certificate is more than three years old, which
    corresponds to a very short lifetime, so that Ttf ~ 0 and 1/Ttf >> 1

1.4 manager    (lifetime = 3 years), single exponential decay
      Tm = 3

1.5 certificate holder turnover of < 1% is neglected in period, Th >> 1
      and 1/Th ~ 0.

There are then 7 effective attributes (N = 7) and 5 original attributes (M =  5).

2. Lifetime calculation:

The average certificate lifetime, with calculation valid before three years are
passed from issuance, is:

1/T =  1/72 + 1/3 + 0 + 1/3 + 0 =  1/1.47

So, the average certificate lifetime is 1.47 years. Since the limit of three years
has not been exceeded, the fast Ttf rate is not used. The certificate should
be invalid due to the other reasons before the telephone changes.

This result can now be compared with the two answers tentatively supplied by
David:

- "I contend that the expected lifetime of this certificate is closer to the minimum
    attribute lifetime (3 years)". This is not so -- the expected lifetime of 1.47 years
    is nearly 50% the minimum attribute lifetime of 3 years.

- "the value indicated by your formula (1/3+1/3+1/3+1/72 = .986 years)". This
   is not so, since the value indicated by the formula is actually 1.47 years when
   Ttf is correctly taken into account.

Comments?

Cheers,

Ed Gerck