Subject: RE: DoD Bridge Certification Authority Phase II Demonstrations

From: Santosh Chokhani <[email-masked]>
Date: Mon, 9 Apr 2001 16:39:16 -0400

Anders:

I think Bridge technology can be helpful to a vertical segment such as
banking, health care, automotive industry etc. in order to facilitate secure
e-commerce among the trading partners where persistent digital signature for
non-repudiation may be required.

Also, given how organizations manage their Web sites and we hear about Web
server break-in, persistent encryption (beyond SSL transport) may call for
interoperable, inter-domain PKI.  Again Bridge CA can help.

Actually, I can see the benefits of layers (strata) of Bridge CAs, e.g.,
Bridge CAs from various vertical segments themselves connecting to a
Omni-Bridge.  In that case, the Bridge CAs will be Principal CAs.

I assume you have had a chance to review the excellent paper on the Bridge
concept developed by Bill Burr.

-----Original Message-----
From: Anders Rundgren [mailto:[email-masked]]
Sent: Monday, April 09, 2001 2:08 PM
To: Fillingham, David W.; PKIX-List; 'KPCMWG'; 'DoD PKI TWG';
[email-masked]; 'Bridge CA Mail List'; 'BCA Integration'; * ALL
FIREBURST USERS *; 'Steve Capps'; Wagner, Clark J.;
[email-masked]; [email-masked]; 'Steve Hanna
(SUN)'; 'Susan Dernik'
Subject: Re: DoD Bridge Certification Authority Phase II Demonstrations

David, 
This is indeed an ambitious project. Unfortunately I doubt that the Bridge
model has any relevance in 
the private sector that for inter-organization communication, is more likely
to deploy domain-based 
PKI-solutions, that have the major advantage of already being supported by
global TTPs which makes
domain security solutions useful for organizations of any size. I.e.
VeriSign's issuance of web-server
certificates is "approximately" what is needed. 

That domain security is incompatible with most current digital signature
laws is a pity.  Particularly for
the lawyers who created them.  :-)

Using domain security, tracing, message archiving, and user-control is
essentially built-in.

A further advantage of domain security models is that client security
solutions can develop in a
different pace at each organization.  As they have for current
Internet-banks that is so far the only
large-scale (almost) secure multi-organization transaction-environment on
the Internet.

The question that comes to my mind is: Will all Governments in the world
continue to adopt the
"All-speak-with-all-PKI" approach in spite of the fact that the private
sector probably have shunned it
due to complexity, privacy concerns, lack of control, and cost?

Regard
Anders Rundgren
X-OBI  read: http://www.x-obi.com/purple  run: http://buyer.x-obi.com 

----- Original Message ----- 
From: Fillingham, David W. 
To: [email-masked]' ; 'KPCMWG' ; 'DoD PKI TWG' ; [email-masked]' ;
'Bridge CA Mail List' ; 'BCA Integration' ; * ALL FIREBURST USERS * ; 'Steve
Capps' ; Wagner, Clark J. ; [email-masked]' ;
[email-masked]' ; 'Steve Hanna (SUN)' ; 'Susan Dernik' 
Sent: Friday, April 06, 2001 16:48
Subject: DoD Bridge Certification Authority Phase II Demonstrations

For the last few years, the National Security Agency has led the development
of Bridge Certification Authority (BCA) technology demonstrations.  In 1999,
Phase One of the Department of Defense BCA Technology Demonstration showed
the technical feasibility of achieving signed e-mail interoperability using
multi-vendor cross-certification in conjunction with chained directory
systems.
 
Phase Two of the demonstration is now ready to be shown.  Phase Two of the
DoD Bridge CA Phase II Technology Demonstration includes: 
 
Technologies: 
  
--  Certificate chain building in complex certificate graphs; 
--  Integration of both mesh-style cross-certified PKIs and hierarchical
PKIs; 
--  Multi-signature/hash algorithm processing in certificate chains; 
--  Certificate acceptance/rejection based on Certificate Policy processing,
including policy mapping;
--  Transitive trust limitation using Name Constraints processing;
--  Access Control using X.509 compliant attribute certificates (same
attribute certificates used for e-mail and web based access control);
--  E-mail access control using S/MIME V3 labeling;
--  E-mail encryption using public key certificates authenticated via a
Bridge Certification Authority;
--  Border Directories;
--  Multivendor directory interoperation via X.500 chaining; and, 
--  Transparent sharing of certificate revocation information across several
PKIs using products of multiple PKI vendors.
 
Client Applications: 
  
--  Baltimore Technologies MailSecure enabled Microsoft Outlook 
--  Entrust Enabled Microsoft Outlook
--  Getronics S/MIME Freeware Library, Certificate Management Library, and
Access Control Library enabled Qualcomm Eudora
--  Getronics Certificate Management Library and Access Control Library
enabled Netscape Web Server 
  
Freeware Libraries: 
  
--  Cygnacom Certificate Path Development Library 
     <http://www.cygnacom.com/products/index.htm> 
--  Getronics S/MIME (Version 3) Freeware Library 
     <http://www.getronicsgov.com/hot/sfl_home.htm> 
--  Getronics Certificate Management Library 
     <http://www.getronicsgov.com/hot/cml_home.htm> 
-- Getronics Access Control Library 
          <http://www.getronicsgov.com/hot/acl_home.htm> 
CA vendor interoperability demonstrations: 
  
--  Baltimore Technologies
--  Entrust Technologies
--  Motorola
--  SPYRUS 
  
Directory Interoperability: 
--  Entrust ICL 
--  Entegrity Safepages Directory 
Demonstrations will be held at the following locations and dates (note that
you MUST REGISTER to attend!  Registration information is provided below):
 
---------- 
CygnaCom 
Suite 100 West 
7927 Jones Branch Dr.
McLean, Virginia 
  
Directions to CygnaCom are located at:
<http://www.cygnacom.com/contact/directions.htm> 
  
26 April 2001 - 0900 
  
26 April 2001 - 1300 
  
16 May 2001 - 0900 
  
16 May 2001 - 1300 
  
--------- 
Getronics Government Solutions 
141 National Business Parkway, Suite 210 
Annapolis Junction, Maryland 
  
From Washington DC: Take I-95 north; take MD Rt 32 east exit; take Dorsey 
Run exit; at stop sign turn left on Dorsey Run; at stop light turn right on 
Guilford Road which becomes National Business Pkwy. 
  
From Baltimore: Take BW Parkway (295) south; take MD Rt 32 west exit; stay 
in right lane of the exit which runs into National Business Pkwy; make a 
right on National Business Pkwy. 
  
30 April 2001 - 1300 
  
8 May 2001 - 0900 
  
8 May 2001 - 1300 
  
24 May 2001 - 0900 
  
24 May 2001 - 1300 
  
--------- 
  
All showings last about half a day - with a mixture of conference room
briefings and laboratory demonstrations. 
  
We are limited by available demonstration space to an absolute maximum of 20
participants at each showing.  
  
IMPORTANT:  PLEASE REGISTER WITH LISA FAULKNER ([email-masked]
<mailto:[email-masked]>) AND MYSELF ([email-masked]
<mailto:[email-masked]>) IF YOU PLAN TO ATTEND.  IF YOU DO NOT
REGISTER TO ATTEND, YOU WILL NOT BE ADMITTED TO THE DEMONSTRATION.
 
Please provide the following information to register: 
  
--  Name 
--  Organization 
--  E-mail address 
--  Date and time of the demonstration showing you wish to attend (with
alternates, if possible) 
  
We look forward to seeing you at the demonstration! 
  
Dave Fillingham 
NSA

---

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 10 Apr 2001 11:21:31 +0200

Santosh,
Domain (server-based) PKI offers persistent signatures for non-repudiation at a fraction
of the cost (and inconvenience) that inter-organization client-based signatures introduce.
The need for bridge-CAs using domain-PKI is IMO very limited as the number of CAs is
reduced by several orders of magnitude by such approaches. 5-10 CAs worldwide is my guess.

I do have read the paper by Bill Burr. Did you read about Purple? I.e. do you see a problem with this model?

BTW, I am a (currently only lurking due to high work-load) member of the OASIS Security Services TC where
domain-based solutions are standardized. I have never ever seen such an enormous committee activity so domain
security is indeed red-hot.

Internet2 with their Shibboleth distributed multi-campus authentication system will be based on domain-PKI.

Personally I expect the next version of OBI (Open Buying on the Internet) to be entirely based
on this concept by throwing out the inter-organization client-certs (that never worked, so just about
everybody turned to user-ID/passwords in spite of not being a part of the standard).

VISA's coming 3D Secure credit-card payment system is also based on domain-PKI.

Due to this, I think that DoD (and similar organizations all over the globe) should very carefully evaluate the
domain security alternative before they do any new investments in CA systems.

Regards
Anders
----- Original Message -----
From: Santosh Chokhani
To: Anders Rundgren ; Fillingham, David W. ; PKIX-List ; 'KPCMWG' ; 'DoD PKI TWG' ; [email-masked] ; 'Bridge CA Mail List' ; 'BCA
Integration' ; * ALL FIREBURST USERS * ; 'Steve Capps' ; Wagner, Clark J. ; [email-masked] ;
[email-masked] ; 'Steve Hanna (SUN)' ; 'Susan Dernik'
Sent: Monday, April 09, 2001 22:39
Subject: RE: DoD Bridge Certification Authority Phase II Demonstrations

Anders:
I think Bridge technology can be helpful to a vertical segment such as banking, health care, automotive industry etc. in order to
facilitate secure e-commerce among the trading partners where persistent digital signature for non-repudiation may be required.
Also, given how organizations manage their Web sites and we hear about Web server break-in, persistent encryption (beyond SSL
transport) may call for interoperable, inter-domain PKI.  Again Bridge CA can help.
Actually, I can see the benefits of layers (strata) of Bridge CAs, e.g., Bridge CAs from various vertical segments themselves
connecting to a Omni-Bridge.  In that case, the Bridge CAs will be Principal CAs.
I assume you have had a chance to review the excellent paper on the Bridge concept developed by Bill Burr.
-----Original Message-----
From: Anders Rundgren [mailto:[email-masked]]
Sent: Monday, April 09, 2001 2:08 PM
To: Fillingham, David W.; PKIX-List; 'KPCMWG'; 'DoD PKI TWG';

David,
This is indeed an ambitious project. Unfortunately I doubt that the Bridge model has any relevance in
the private sector that for inter-organization communication, is more likely to deploy domain-based
PKI-solutions, that have the major advantage of already being supported by global TTPs which makes
domain security solutions useful for organizations of any size. I.e. VeriSign's issuance of web-server
certificates is "approximately" what is needed.
That domain security is incompatible with most current digital signature laws is a pity.  Particularly for
the lawyers who created them.  :-)
Using domain security, tracing, message archiving, and user-control is essentially built-in.
A further advantage of domain security models is that client security solutions can develop in a
different pace at each organization.  As they have for current Internet-banks that is so far the only
large-scale (almost) secure multi-organization transaction-environment on the Internet.
The question that comes to my mind is: Will all Governments in the world continue to adopt the
"All-speak-with-all-PKI" approach in spite of the fact that the private sector probably have shunned it
due to complexity, privacy concerns, lack of control, and cost?
Regard
Anders Rundgren
X-OBI  read: http://www.x-obi.com/purple  run: http://buyer.x-obi.com

----- Original Message -----
From: Fillingham, David W.
To: [email-masked]' ; 'KPCMWG' ; 'DoD PKI TWG' ; [email-masked]' ; 'Bridge CA Mail List' ; 'BCA Integration' ; * ALL
FIREBURST USERS * ; 'Steve Capps' ; Wagner, Clark J. ; [email-masked]' ; [email-masked]' ; 'Steve Hanna
(SUN)' ; 'Susan Dernik'
Sent: Friday, April 06, 2001 16:48
Subject: DoD Bridge Certification Authority Phase II Demonstrations

For the last few years, the National Security Agency has led the development of Bridge Certification Authority (BCA) technology
demonstrations.  In 1999, Phase One of the Department of Defense BCA Technology Demonstration showed the technical feasibility of
achieving signed e-mail interoperability using multi-vendor cross-certification in conjunction with chained directory systems.

Phase Two of the demonstration is now ready to be shown.  Phase Two of the DoD Bridge CA Phase II Technology Demonstration includes:

Technologies:

--  Certificate chain building in complex certificate graphs;
--  Integration of both mesh-style cross-certified PKIs and hierarchical PKIs;
--  Multi-signature/hash algorithm processing in certificate chains;
--  Certificate acceptance/rejection based on Certificate Policy processing, including policy mapping;
--  Transitive trust limitation using Name Constraints processing;
--  Access Control using X.509 compliant attribute certificates (same attribute certificates used for e-mail and web based access
control);
--  E-mail access control using S/MIME V3 labeling;
--  E-mail encryption using public key certificates authenticated via a Bridge Certification Authority;
--  Border Directories;
--  Multivendor directory interoperation via X.500 chaining; and,
--  Transparent sharing of certificate revocation information across several  PKIs using products of multiple PKI vendors.

Client Applications:

--  Baltimore Technologies MailSecure enabled Microsoft Outlook
--  Entrust Enabled Microsoft Outlook
--  Getronics S/MIME Freeware Library, Certificate Management Library, and Access Control Library enabled Qualcomm Eudora
--  Getronics Certificate Management Library and Access Control Library enabled Netscape Web Server

Freeware Libraries:

Directory Interoperability:
--  Entrust ICL
--  Entegrity Safepages Directory
Demonstrations will be held at the following locations and dates (note that you MUST REGISTER to attend!  Registration information
is provided below):

----------
CygnaCom
Suite 100 West
7927 Jones Branch Dr.
McLean, Virginia

Directions to CygnaCom are located at:  <http://www.cygnacom.com/contact/directions.htm>

26 April 2001 - 0900

26 April 2001 - 1300

16 May 2001 - 0900

16 May 2001 - 1300

---------

30 April 2001 - 1300

8 May 2001 - 0900

8 May 2001 - 1300

24 May 2001 - 0900

24 May 2001 - 1300

---------

All showings last about half a day - with a mixture of conference room briefings and laboratory demonstrations.

We are limited by available demonstration space to an absolute maximum of 20 participants at each showing.

IMPORTANT:  PLEASE REGISTER WITH LISA FAULKNER ([email-masked] <mailto:[email-masked]>) AND MYSELF
([email-masked] <mailto:[email-masked]>) IF YOU PLAN TO ATTEND.  IF YOU DO NOT REGISTER TO ATTEND, YOU WILL NOT BE
ADMITTED TO THE DEMONSTRATION.

--  Name
--  Organization
--  E-mail address
--  Date and time of the demonstration showing you wish to attend (with alternates, if possible)

Dave Fillingham
NSA

---

From: Roger Younglove <[email-masked]>
Date: Tue, 10 Apr 2001 09:14:58 -0400

IMHO, when you have multiple PKIs with in any industry such as the 
Automotive (ie. ANX) or the Government, cross certification become a 
problem because the certificate chain of trust becomes so unwieldy and 
revocation of a PKI is also a problem. The Bridge scenario solves this 
problem. It is not the only solution but the simplest with a number of 
existing PKIs.
At 05:21 AM 04/10/2001 , Anders Rundgren wrote:
>Due to this, I think that DoD (and similar organizations all over the 
>globe) should very carefully evaluate the
>To: Anders Rundgren ; Fillingham, David W. ; PKIX-List ; 'KPCMWG' ; 'DoD 
>PKI TWG' ; [email-masked] ; 'Bridge CA Mail List' ; 'BCA
>banking, health care, automotive industry etc. in order to
>facilitate secure e-commerce among the trading partners where persistent 
>digital signature for non-repudiation may be required.
>server break-in, persistent encryption (beyond SSL
>Bridge CAs from various vertical segments themselves
>'Bridge CA Mail List' ; 'BCA Integration' ; * ALL
>FIREBURST USERS * ; 'Steve Capps' ; Wagner, Clark J. ; 
>[email-masked]' ; [email-masked]' ; 'Steve Hanna
>(SUN)' ; 'Susan Dernik'
>For the last few years, the National Security Agency has led the 
>development of Bridge Certification Authority (BCA) technology
>demonstrations.  In 1999, Phase One of the Department of Defense BCA 
>Technology Demonstration showed the technical feasibility of
>achieving signed e-mail interoperability using multi-vendor 
>cross-certification in conjunction with chained directory systems.
>
>--  Transparent sharing of certificate revocation information across 
>several  PKIs using products of multiple PKI vendors.
>
>Client Applications:
>
>Demonstrations will be held at the following locations and dates (note 
>that you MUST REGISTER to attend!  Registration information
>is provided below):
>
>----------
>CygnaCom
>Suite 100 West
>7927 Jones Branch Dr.
>McLean, Virginia
>
>Directions to CygnaCom are located 
>at:  <http://www.cygnacom.com/contact/directions.htm>
>
>26 April 2001 - 0900
>
>26 April 2001 - 1300
>
>16 May 2001 - 0900
>
>16 May 2001 - 1300
>
>---------
><mailto:[email-masked]>) AND MYSELF
>([email-masked] <mailto:[email-masked]>) IF YOU PLAN TO 
>ATTEND.  IF YOU DO NOT REGISTER TO ATTEND, YOU WILL NOT BE

--------
TTFN
Roger W. Younglove, CISSP
Distinguished Member of Consulting Staff
Lucent Worldwide Services--Information Security
100 Galleria Officentre, Ste. 220
Southfield, MI 48034-8428
Numeric page: 888.935.6755
E-mail page:
[email-masked]
eFax number: 413.425.5368
www.lucent.com/netcare

---

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 10 Apr 2001 18:59:59 +0200

Roger,

>problem. It is not the only solution but the simplest with a number of 

Agreed, Bridge CAs solves (some of) the problems created by
unwieldy PKIs such as those created by DoD.

Domain-PKI does not requires such solutions as it is much simpler
to create and maintain.  100 millions users of Internet use it today
when they address an https URL.  That's simplicity IMHO.
Applied to B2B it gets just slightly more complicated.

Anders

--------
TTFN

---

From: "Frank Lawrence" <[email-masked]>
Date: Tue, 10 Apr 2001 13:40:33 -0400

I will take a shot of the problem with the purple model.

The problem that I see with the Purple model is that there is a requirement for
explicit trust between the "partners".  Known partners are nice but does not solve
the broader problem of extending trust.

Works fine as long as the number of partners is small, but is combinatorially
explosive as the number of partners becomes large.   The ability to manage that
large number of trust relationships becomes just as difficult as the bridge CA
problem.  The "unwieldy" PKI created by DoD elminates that problem, at least within
DoD where there are hundreds (maybe thousands?) of "partner" domains.  At least
within DoD there is an understanding of the level of trust involved in getting a
certificate.

The current HTTPS model is a bad example of trust because there is no (valid)
presumption of trust between a web server and a client.  SSL encrypts the pipe but
there is no method for determining if the client or the server is who they claim to
be.  Trivial to spoof either (or both) although the pipe is secure from
observation.  Even IPSEC based authentication (a step above the SSL model) does not
provide any assurance that the claimed user is who they say they are.  Unless there
is a trust model that extends across the network, in a scalable manner, then the
relying party is left holding the bag.

Finally, to trust a domain, you must understand how that domain issues
certificates.  If there is no policy which tells a relying party what the level of
assurance is involved in the creation of the certificate, then the level of trust
you place in that certificate is zero.

---

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 10 Apr 2001 21:37:04 +0200

Frank,

> I will take a shot of the problem with the purple model.

Thanx for taking on the challenge!

Even the Sun has its flaws.  But that does not make domain-PKI useless.

Domain PKI references:

Purple (X-OBI's domain-PKI authentication system):
Read: http://www.x-obi.com/purple 
Run: http://buyer.x-obi.com 

Why client-certificates have no [direct] use in B2B:
   http://www.mobilephones-tng.com/papers/obi-2.1-sec.doc

S/MIME for domains:
  http://www.ietf.org/internet-drafts/draft-ietf-smime-domsec-08.txt

OAISIS Security Services:
  http://www.oasis-open.org/committees/security/

VISA's 3D SET (that though will be replaced by 3D Secure which so far I cannot disclose info about):
  http://www.visa.com/pd/eu_shop/merchants/3d_set/main.html#threedomain

Early mobile phone concept based on domain-PKI and client-PKI in a "combo"
  http://www.mobilephones-tng.com

Internet2's Shibboleth inter-campus web-authentication system:
  http://middleware.internet2.edu/shibboleth/

> the broader problem of extending trust.

Now you hit a weak point in PKI in general.  What do we mean by trust?  That the
entity is the one they are claiming to be?  I do not belie (PKI is a religion?)
that it is enough that you have a certificate from a trusted CA.  Because if you want
to conduct business you may actually be more interested in knowing that a buyer
is capable of paying or that the supplier delivers.  Such information can sometimes be
obtained from TTP's specializing in such data (e.g. D & B).  By identifying the entity
with their organization certificate you have the "perfect handle" for perfoming such
queries.   And how much trust you have in an unkown organization is up to every
partner to decide.  I.e. a CA <> God!

> explosive as the number of partners becomes large.

No, domain-PKI follows a linear scale as partners are autonomous.  I.e. domain-PKI
is simply a way for an organization to sign messages using a digital version of their
company paper.  But unlike the paper-version, the digital version is usually issued by
a TTP and is extremely hard to forge.

>  The ability to manage that

Many companies have more than 10000 suppliers, domain-PKI adds little
to the complexity (in principal at least).  And it definitely beats current 
"state-of-the-art-solutions" using user-ID passwords on partner sites.

> relying party is left holding the bag.

Client-PKI does not make you safe from impersonators, or does it?
 
> you place in that certificate is zero.

If you refer to the Purple tickets they are no different than purchase orders (which 
BTW is sort of a certificate).  If you trust the purchase orders you ought to be able to
trust tickets as they are created about the same way by the very same system
run by the very same organization and staff.

But the motives for domain-PKI have so many more elements that I could go on
the whole night to describe them all but I think it is better to go through the
references instead of just repeating myself.

====================================================
With the exception of end-to-end authentication, domain-PKI IMO seems to
beat client-based PKIs for B2B by a mile.  Regarding end-to-end authentication
of Purple tickets (and Shibboleth and SAML dittos),  I have BTW a few suggestions
that I would like to discuss with interested parties.  It looks like this indeed can be
solved in a very convenient way (no local client configuration) but it requires an upgraded
browser.
====================================================

Anders

---

From: "Frank Lawrence" <[email-masked]>
Date: Tue, 10 Apr 2001 16:33:32 -0400

Embedded stuff below:

> partner to decide.  I.e. a CA <> God!

I agree this is the generic problem with PKI as implemented in the commercial world where there is no
control of the issuing process.  The certificate policy in use at any CA is, in general, very weak.  A
strong (and enforced) certificate policy provide better assurance.  The stronger the mechanisms (such as
hardware token vice storing keys on hard drive) the higher the assurance level.

> a TTP and is extremely hard to forge.

Each organization of N must maintain n-1 relationships if the they all must have trust with each other.
If I remember my analysis of algorithms class correctly (it has been several years!), that is N^n-1
relationships,  which I do not believe is linear.

> "state-of-the-art-solutions" using user-ID passwords on partner sites.

Agree that userid and password is not a good solution.  Its the "in principle" I am concern with.  If
all 10000 were issued by someone they all trust, then the maintenance of the relationships is
definitiely simpler.  In the commercial world, that is probably NOT realistic.  In an organization with
several thousand domains IN it (like DoD), it certainly has its advantages, especially when you allocate
the time and resources needed to have a high assurance issuance policy.

> Client-PKI does not make you safe from impersonators, or does it?

If you trust the CA and the user maintains control of the private identity key then yes.  Who do you
trust and why is the critical issue.  Most organizations do not have the discipline to make and enforce
a high assurance certificate policy.

> run by the very same organization and staff.

I think a lawyer would tell you that you trust in the purchase order comes from the wet signature on the
purchgase order, not the form itself.  If taken to court, the signature will be the subject of the
discussion, not the form.  If the purple ticket is issued without any authentication required for the
person who gets the ticket, that is like setting a stack of signed blank forms at the receptionists
desk!  If I hack a local client, does the server provide appropriate credentials when I go out and order
things which are not required?  Is the company which owns the server liable for the orders placed?