Subject: Re: The case against directories

From: [email-masked]
Date: Fri, 21 Mar 2003 08:02:46 -0700

>2. Internal information (including employment) is generally not public

in fact, for earlier public PKI certificate-based information, the eventual
result (because of difficult privacy issues, both individual and
institutional, taking some liberty to translate privacy as both a personal
concept as well as an institutional concept) was the lowest common
denominator, a certificate that only contained a institutional number (ex:
various financial certificates) and nothing else, which then were only used
in context of rely-party-only certificates.

the cross domain issues have not been technical (they effectively have all
been a form of privacy, either individual or institutional) .... they were
not technical some 15 years ago with cross-domain kerberos, there were not
technifcal some 6-8 years ago with cross-domain PKI certificates, and they
probably won't be technical this time around with directories. another
simple example of the reduction of information has been the dig/nslookup
responses from  the biggest internet "public" directories, the DNS
root-servers. Over the last five years, nearly all "privacy" information
has disappeared from public responses (like name, address, telephone
number, and email  of administrative and technical contacts).

DNS directories are an example of an online internet information source for
a couple decades and the issue isn't that the praadigm doesn't work, but
there are significant privacy issues (personal & institutional).

And as one of my common references .... certificates are just stale, static
representation of a database/directory entry that exists somewhere ... and
the personal & instititional privacy issues aer common, regardless of the
representational format.

--
Internet trivia, 20th anv: http://www.garlic.com/~lynn/rfcietff.htm

                     "Anders Rundgren"                                        
                    <anders.rundgren@t     To:      <[email-masked]>       
                             elia.com>     cc:                                
                              Sent by:     Subject:      The case against     
                    owner-ietf-pkix@ma        directories                     
                            il.imc.org                                        

                      03/21/2003 01:21                                        
                                    AM                                        

I would like to add a few things to what Phillip Hallam-Baker of
VeriSign wrote about directories as an obstacle to PKI deployment.

Many  PKI experts are involved in huge public-sector-driven projects,
that are based on establishing directory interoperability between
organizations.  At first sight this looks like a great idea but digging
a bit further, you soon note that this is not a universal solution but
rather a dead end.

Directory problem issues
1. Technical.  Unifying schemas + firewall issues
2. Internal information  (including employment) is generally not public
3. The level of openness depends on who is asking
4. Directories represent just one way to organize data

But, there is no reason to despair, as there are work-arounds that
properly addresses all these issues:

Using authentication systems like OASIS' SAML, organizations can
(through their employees), authenticate to each others' intranets and
through this get access to exactly the information they should have
and in a format that make sense.  The latter may be a directory tree,
a PDF-file, a database listing, an HTML form, etc.

Unlike directory systems, SAML allows secure access to any kind
of active or passive information source, including purchasing and
work-flow systems.

All using the truly universal Internet browser interface.

For machine-to-machine (=automated) access to external information,
specialized Web Services seems to be a much more extensible route
than directories, as the former introduces no restrictions on data.

Anders Rundgren
Independent consultant PKI and secure e-business

---

From: David Chadwick <[email-masked]>
Date: Sat, 22 Mar 2003 14:26:46 +0000

Lynn

well said. Access controls and privacy issues apply regardless of
technologies.

David

-- 
*****************************************************************

David W. Chadwick, BSc PhD
Professor of Information Systems Security
IS Institute, University of Salford, Salford M5 4WT
Tel: +44 161 295 5351  Fax +44 01484 532930
Mobile: +44 77 96 44 7184
Email: [email-masked]
Home Page:  http://www.salford.ac.uk/its024/chadwick.htm
Research Projects: http://sec.isi.salford.ac.uk
Seminars: http://www.salford.ac.uk/its024/seminars.htm
Entrust key validation string: MLJ9-DU5T-HV8J
PGP Key ID is 0xBC238DE5

*****************************************************************