Subject: A Heretic's view of Certificates

From: "Anders Rundgren" <[email-masked]>
Date: Sat, 17 Jun 2000 10:34:36 +0200

Interesting reading.  Particularly for PKI "fundamentalists"....

-----Original Message-----
From: [email-masked] <[email-masked]>
To: [email-masked] <[email-masked]>
Date: Friday, June 16, 2000 22:14
Subject: another view of certificates

>
>
>for another view of certificates
>
>http://www.DGA.co.uk/customer/publicdo.nsf/public/WP-HERESY
>
>

---

From: Stephen Kent <[email-masked]>
Date: Mon, 19 Jun 2000 16:11:24 -0400

Anders,

Part of this material, like the Schneier and Ellison article, makes 
the mistake of equating X.509 with the trusted third party model of 
VeriSign, CyberTrust, etc.  The figure in Section 4 illustrates this 
bias. The author acts as thought the 10 point list from that article 
is some sort of holy grail, rather than what is really was, i.e., a 
list of points of a length inspired by David Letterman.

The discussion of revocation is a bit naive. It seems to assume a 
push model, whereas traditional X.509 is pull, as is OCSP.  The 
argument about the implied net traffic associated with maintaining 
CRLs for a very large population is just  hand waving, with no good 
analysis.

The author places way too much emphasis on the browser model of a 
PKI, which is not a very good one, especially for the B2B 
transactions that are the focus of the article.  Again, a strawman.

The author's most significant criticisms of current PKI models are 
contained in Section 5, and there are several seriously flawed 
arguments. For example, he claims that some of the conditions that he 
sets as requirements cannot be met because existing (already issued) 
certs do not meet these requirements.  This is an interesting 
criticism, since the suggestion is that one can develop and deploy a 
new, different system (of the author's design) but cannot reissue 
certs to meet his declared requirements!  He misunderstands options 
for retention of certs and CRLs in support of NR, and argues that 
anything that LDAP does not do now will not change.  (Anyone who has 
followed the progress of LDAP would know better!) More errors arise 
in this discussion, but one ought not be surprised since the goal of 
this section is as a strawman to motivate the author's proposal.

Most, if not all, of what the author proposes, in Section 7, can be 
effected with X.509 certificates, based on PKI models that are 
organizational and/or geopolitical in scope, rather than TTP-based 
PKIs.  Some details of his proposals require changes (or usage 
restrictions) to current e-mail and web protocols. (For example, the 
function assigned to a secure e-mail proxy could be effected using 
the S/MIME triple-wrapping feature. The author alludes to signing an 
"SMTP envelope," which causes me to question the depth of his 
protocol knowledge.)  If these functions were deemed important, they 
could be supported just as well with X.509 as with his newly minted 
"credentials."  Other aspects of this model merely reflect 
implementation choices for such PKI elements as certification policy 
statements.  Some aspects of model also appears to be consistent with 
the ongoing PKIX work on delegated cert path validation, for those 
who desire to adopt this approach. The model is thus a mix of new 
data types, implementation options, and a few assurance mandates.

Finally, when one gets to the end of this text, it appears to be 
promotional (marketing) material for some products/services that the 
author is hoping to sell.

So, Anders, what exactly was your point?

Steve