Subject: PKI and trust.....(changing topic a bit from secure email)

From: <[email-masked]>
Date: Mon, 12 Nov 2001 10:50:52 -0800

Ah, so we are back to one of the original questions of everyday
transactions - Who do I trust and just how much do I really trust them?

On an everyday basis, people everywhere apply some decision making process
(with or without full awareness of the process) to every transaction that
occurs between them. To take this a step further, business policy applied to
computing systems often tries to make this sort of decision process and
apply it to applications.  PKI is one way that this trust binding is
attempted and it often fails quite miserably. Humans seem to do this
relatively effortlessly based on thier experiences.

What's really wrong with PKI is that is it is difficult for most people to
implement and costly to use and it just doesn't happen as quickly as some
human judgment call on who they trust in any transaction.  Where is the
granularity of trust levels, the recognition that trust is temporal and
transitive presented in a fairly simple way for the everyday programmer use?

We can now plaster the world with X509 certificates in various forms that
work the way it was intended (and this has taken several years) but we as a
group have done little to make it easy and relatively idiot proof to use PKI
in applications (and there are many
perfect idiots in our wide world).

I have looked into and tested many a CA vendor's toolkit and let me say it
just isn't easy to use any of them. Where is the application enabling
middleware that is easy to use? (Yes, there are several other standards
groups addressing this is some piecemeal fashion and there are some vendors
who are beginning to address this space.)

 I look at a lot of the work being done with PKI and XML in wonderment of
really allowing the "average"  (read, less experienced) programmer who will
follow some standard and then really botch things up, expose keys, etc due
to lack of knowledge on how to do it securely.

Let's get real and do something about all this, that makes PKI an easy and
reliable method of enabling trust on an everyday basis with all the goodness
that PKI offers instead of making it so difficult that the average user
would rather get a root canal than use PKI.

Just my opinion,

	Jean Pawluk

PS As an architect and senior manager I am often astounded how many firms do
not know thier own business well enough to decide what needs to be secured.

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Henrik Bergman
Sent: Monday, November 12, 2001 7:03 AM
To: todd glassey
Cc: [email-masked]; [email-masked]
Subject: Re: Signed e-mail

Todd, I mean

1. humans, e-mail read and processed by you and me.
2. computers, business transactions between business systems over Internet.
Data transferred between
systems without any manual interception. Computers that are used in business
or processing industry.

And ofcause "2. computers" are always some kind of digital agents in service
for humans in the end.
But they are without human control in the daily life transactions. The human
part comes later in the
process.

Can anyone else understand this??

/Henrik

todd glassey wrote:

> ----- Original Message -----
> From: "Henrik Bergman" <[email-masked]>
> To: <[email-masked]>; <[email-masked]>
> Sent: Sunday, November 11, 2001 9:55 PM
> Subject: Signed e-mail
>
> >
> > >Khaja, you are pointing to a very important thing.
> > >
> > >The need of signed messages for two categories:
> > >1. Humans
> > >2. Computers
>
> You of course mean "Too their Digital Agents"
>
> > >
> > >For humans, the need isn't very big if we are talking about
> > >authentic messages. I think many of us
> > >already know what contents a message could contain. If it doesn't
> > >contain things from that area, we
> > >will suspect that something is wrong. There for the value for signed
> > >e-mails  is limited. Especially
> > >is you consider how much work it usually is to maintain your
> > >certificates and program installations.
> > >
> > >If we continue to the next category, computers, the need is quite
> > >different. We still don't have any
> > >Java-objects for AI around telling the business application when we
> > >should suspect the transaction
> > >to be faulty. Therefor computer to computer in B2B is an ideal
> > >situation for PKI. But as you pointed
> > >out, the interoperability between different CA's is very low. And I
> > >remember a long lived discussion
> > >on this list about "Basic Cert-2-Directory mapping". The discussion
> > >showed (at least myself) that
> > >standards do not tell anything about what (minimum) a certificate
> > >should contain, only what it COULD
> > >contain. This opens a wide variety of certificates, all following
> > >the standard of cause, that
> > >confuses the market. This will lead us to a discussion about the
> > >need for permanent identifiers.
> > >
> > >Bob once said, the only this a CA could guarantee is a unique (with
> > >this CA) number. Everything else
> > >is just a snapshot (Bob didn't said that, I added it!) and will vary
> > >over the time.
> > >
> > >So what's the conclusion?
> > >
> > >For me it's that certificates and signed messages should be used in
> > >B2B between computers
> > >(especially for $1M transactions).
> > >Certificates should be simple (subject contents), as most vital and
> > >dynamic information is available
> > >from other sources ONLINE!
> > >
> > >Regards
> > >
> > >Henrik Bergman
> > >X-OBI AB
> >
> > --
> > __________________________________________
> > Henrik Bergman, X-OBI, mob 070-866 87 72
> > e-mail: [email-masked]
> >
> >
> >

--
__________________________________________
Henrik Bergman, X-OBI, mob 070-866 87 72
e-mail: [email-masked]