Subject: RE: Employee Certificates - Security Issues

From: "Guida, Richard [JJCUS]" <[email-masked]>
Date: Fri, 4 Oct 2002 10:09:53 -0400

Anders - forgive me but you have a simplistic and incorrect view of how
things really work.  A digital identity certificate proves (to whatever
degree the certificate policy underlying it affords) identity.  It does not
prove authority to take an action.  (I am omitting attribute certs from this
discussion.)  Today, we all face the same issue in an electronic world when
we use a password or PIN to prove who we are.  There is still that critical
authorization step which has to be gone through before an action consummates
(or before a "relying party" should accept the action) - i.e., is the person
authorized to take the action.  Substituting a digital signature for an
electronic signature made using a PIN or password (permitted between
companies under US law and, I believe, the European e-sig directive) is a
positive step, not a negative one.  So you should think of a company-issued
digital certificate as an electronic credential proving, in a more efficient
and profound way, who the named party in the cert is (and possibly what role
he/she occupies, such as quality control inspector).  That's all it does,
nothing more and nothing less.  And that makes it eminently more powerful
than the use of passwords/PINs which, as we all know, are system "shared
secrets" and thus oxymorons.  Not to say they won't be used for a long time
to come - but I certainly hope to free my children from the tyranny of
dozens of passwords and migrate them to the strength of a single digital
credential, a certificate, with the private key held on a hardware token and
unlocked using a passphrase known only by the token, not by a server
somewhere out of my control.  Best regards -- Rich

Richard A. Guida
Director, Information Security (Medical Devices and Diagnostics)

Johnson & Johnson
One J&J Plaza, Room WH6132
New Brunswick, New Jersey  08933

E-mail: [email-masked]
Office:  732 524 3785

-----Original Message-----
From: Anders Rundgren [mailto:[email-masked]]
Sent: Friday, October 04, 2002 1:25 AM
To: [email-masked]
Subject: Employee Certificates - Security Issues

"I, the Company"

When employees have been equipped with digital certificates,
linked to the organization, interesting things happen: Employees
can now sign on behalf of the organization.  Due to the absence of
a generally understood X509 "authority" system, you can probably
sign whatever you want and an external receiver is meant to believe
that you have the right to do it.  This is probably as far from an
organization-adapted solution one can get (as organizations want to
have control over their internal and external actions), and is an
indication that this scheme is not suitable for large-scale deployment.

As a countermeasure one could think of having an 
"authority control server" checking and logging all employee actions.
Unfortunately that does not work; if you have an employee certificate
you can fairly easy create messages that to receivers, look perfectly
valid without going trough the authority server.

Summary: An architecture that is fundamentally broken.
And, yes, I forgot to mention costs, privacy, archiving, and
the multitude of roots that you have to cope with.

Comments?

Anders Rundgren

---

From: "Anders Rundgren" <[email-masked]>
Date: Fri, 4 Oct 2002 16:36:40 +0200

Richard,

>Anders - forgive me but you have a simplistic and incorrect view of
>how things really work.  

I forgive you.  But don't forget that the outside world does not have
this granularity.  It is probably even more "simplistic" than I am :-)

>A digital identity certificate proves (to whatever degree the certificate
>policy underlying it affords) identity. 
>It does not prove authority to take an action. 

Agreed, but what about purchase orders to take a simple example.
If the partner (the employee's organization) is already a customer, I
would say that most orders would be expedited as the identity of
the employee is of secondary importance.  That the purchase order
was created on a market-place somewhere and that the employee
"forgot" to notify purchasing about it, is an example of a very low-
quality IT-architecture that I would not spend a penny on. 

That my company can sue me _after_ they filed for bankruptcy
due to my ordering of that big 4WD-car is a limited comfort. 
Using the Internet-bank model I would have not been able to do
this purchase at all.  It is always _much_ cheaper to solve
problems _before_ they are actually created :-)

cheers,
Anders