Subject: Re: IBM alternative to PKI?

From: [email-masked]
Date: Thu, 16 May 2002 10:59:36 -0600

i.e. middle-man tends to represent transition/roll-out solutions .... not
security infrastructure solutions.

from traditional security

* end-to-end

middle-man approaches tend to always negate any end-to-end attribute

* additional steps represent additional vulnerabilities

middle-man approaches increase the number of steps/processes .... each of
which represent an additional vulnerability, each additional vulnerability
represents additional points of failure/fraud

* only as strong as the weakest link

shared-secret password paradigm in series with digital signature isn't
additive.

* 2-factor authentication

secret password (as opposed to shared-secret password) in conjunction with
hardware token (i.e. processing in parallel instead of in series)
represents a combination link (both hardware token and secret password has
to be compromised). a shared-secret password process in series with a
digital signature process can fail with just the shared-secret password.

---

From: "Anders Rundgren" <[email-masked]>
Date: Fri, 17 May 2002 11:21:34 +0200

Lynn,

That was a rather prejudiced description of  server-based PKI.

There must be a reason why 42M people use Internet-banks just in
Europe.  These banks serve as giant "proxies" and I don't see how
Internet-banks could ever be replaced by client-side PKI solutions!
Do you?

I.e. the use of a "middle-man" or "proxy" has other qualities than
just enabling PKI-transition/roll-out.

Another example are B2B-systems, where clients must perform
actions *through* the local business system which enforces the
authorization and policy rules.  In addition to storing in- and out-
going business-messages.  A structure that is in daily use since at
least 20 years back or more, so it is definitely time-proven. 

And what's more, employees' privacy is protected by this arrangement.

By using server-PKI, companies and banks can abandon expensive
leased-lines and use the Internet.  Probably with an increase in security
compared to today.  Message integrity control is essentially for free
using PKI.

Server-PKI actually supports end-to-end security as well, although
there are two pair of end-points: client-to-proxy, proxy-to-rp.
When/If client-side PKI becomes ubiquitous, it just makes the link
between the proxy and client stronger.  Including NR support in case
the proxy want to sue the client for malpractice.  Or the reverse BTW.

I think the real discussion is really what constitutes an "end-point".
In B2B it does not have to be an individual as an individual is not
a company.   Few PKI-lawyers understand this as companies cannot
"sign" in the paper-world.  But in the "e-world" that's a piece of cake!

In case you want to try a B2B-system implementing server-based PKI,
using XML-Signatures for all B2B-communication, you are invited
to try out https://buyer.x-obi.com/BuyerASP/buyer
Properly written, and protected by firewalls, HW-crypto, and secured
physical facilities, such systems can work wonders.  As Internet-banks
already do, and that on a massive scale.

The only "business" that so far has not fully grasped the usefulness
of using server-PKI is the public sector, but I stay confident that
they soon will, as running a government authority should be rather
similar to running a company.  I.e. there are internal and external
communication, policies etc. that means that you must have a
"proxy" somewhere in your organization to maintain this in a
reasonable way.  The net effect is the external communication
will be performed by the proxy rather than by the employees.

Cheers,
Anders

----- Original Message ----- 
From: <[email-masked]>
To: "Anders Rundgren" <[email-masked]>
Cc: "Dean Adams" <[email-masked]>; <[email-masked]>; <[email-masked]>
Sent: Thursday, May 16, 2002 18:59
Subject: Re: IBM alternative to PKI?

* end-to-end