Subject: Re: PKI International Consortium

From: Arshad Noor <[email-masked]>
Date: Fri, 02 Apr 2004 13:39:44 -0800

I would concur with you, Steve, that a single certificate that serves all 
purposes, is neither practical nor desirable.  (Although I must confess
to occassionally dreaming of such a utopian environment, sometimes).

However, I believe, it is reasonable - assuming appropriate policy, 
process, implementation and most importantly, cooperation - to have 
industry-specific identities that may serve us all better.  ("Identity
Firewalls" - http://www.strongauth.com/newsletters/2003Jan17.html).

Companies waste far too much time and money today, building 
duplicate identity infrastructures - and consequently tying their own
hands with context-sensitive identities - because it appears to be the
path of least resistance to them.  But as the cost of identity theft &
of managing those numerous identity infrastructures surpasses the 
perceived savings from using this path of least resistance, companies 
will be forced to rethink that strategy.

Arshad Noor
StrongAuth, Inc.

----- Original Message -----
From: Stephen Kent <[email-masked]>
Date: Friday, April 2, 2004 8:47 am
Subject: Re: PKI International Consortium

> 
> At 10:57 AM -0500 4/2/04, [email-masked] wrote:
> >Hello everyone,
> >
> >I appreciate your feedback and most of the replies were referring to
> >identrus.com . My basic concern is from a customer's point of 
> view. If I
> >have a digital certificate issued by a single authority that is 
> considered>trusted internationally by all financial as well as 
> other commercial
> >institutions, then I do not require to have a certificate for 
> Institution>-1 and another for Institution -2. Do we have 
> something in place that takes
> >of this issue. I would be happy to carry and protect that one 
> certificate>which is trusted by everyone.
> >
> >Thank you,
> >
> >Shaheen Nasirudheen
> >JPMorgan ACCESS, Portal Security
> >978 805 1815
> >
> 
> The notion of the one cert that is good for everything is probably 
> never going to be a reality, fortunately. Note there there are no 
> physical credentials that have this property. Why would you 
> believe 
> that digital credentials could overcome the organizational 
> obstacles 
> that contribute to the existence of context-limited credentials? 
> Moreover, consider the awful consequences associated with a 
> compromise of the private key associated with such a cert, if it 
> existed.
> 
> Steve
> 
>

---

From: Stephen Kent <[email-masked]>
Date: Mon, 5 Apr 2004 11:16:29 -0400

>Firewalls" - http://www.strongauth.com/newsletters/2003Jan17.html).

two observations:
	- the implicit ad for your company in the URL above is 
inappropriate for the PKIX list

	- although one might imagine such certs, there are 
significant adverse privacy implications (see 
http://www.nap.edu/books/0309088968/html/)

>will be forced to rethink that strategy.

identity theft would likely be a bigger concern if we have fewer certs.

finally, I am concerned that your message seems to be so closely 
aligned with you company's products. if you want to continue this 
discussion, please do so without making it seem like an ad for your 
company's products and services.

Steve

---

From: Arshad Noor <[email-masked]>
Date: Mon, 05 Apr 2004 23:27:56 -0700

Stephen Kent wrote:

  > two observations:
>     - the implicit ad for your company in the URL above is inappropriate 
> for the PKIX list

	If so, I apologize.  This is the only archived copy of the
	newsletter, and it seemed appropriate to provide the URL to the
	article rather than repeat the concept. However, I will be more
	cognizant of that in the future.

>     - although one might imagine such certs, there are significant 
> adverse privacy implications (see 

	I will address this after I have had an opportunity to read
	the book.
> identity theft would likely be a bigger concern if we have fewer certs.
	I do not believe identity theft will ever be eradicated
	regardless of the number of certs.  However, if we assume
	that identity certs are useful, then there is some optimal
	number that balances the risk against the inconvenience of
	carrying too many credentials.  In the absence of objective
	research recommending the precise number, or range, the
	identity firewalls concept advances one figure.

> finally, I am concerned that your message seems to be so closely aligned 
> with you company's products. if you want to continue this discussion, 
> please do so without making it seem like an ad for your company's 
> products and services.
> 
	The message expressed a concept for how digital certificates
	can be used to solve some problems in a different way, Steve.  	
	No more, no less.

Arshad Noor
StrongAuth, Inc.

---

From: Stephen Kent <[email-masked]>
Date: Tue, 6 Apr 2004 09:21:28 -0400

At 11:27 PM -0700 4/5/04, Arshad Noor wrote:

	<SNIP>
>	identity firewalls concept advances one figure.

My comment said nothing about eradicating identity theft. My 
suggestion is that the IMPACT of an identity theft incident would be 
worse if there are fewer credentials (e.g., certs) associated with an 
individual, rather than more. That notion is based on the assumption, 
stated elsewhere, that when we have more credentials, each has a 
narrower scope than if we have fewer, and thus the impact of a 
compromised credential is less severe.

There is no reason to believe that there is an optimal number of 
credentials for an individual, since other factors affecting the ease 
of identity theft have to do with the procedures used to issue the 
credentials, and the extent to which secondary for selected 
credentials are condoned. In fact, secondary uses are a major factor 
in identity theft, which is often more of a procedural failure than a 
technical, credential failure. That is also why one ought not assume 
that use of certs, as a specific form of credential, will eradicate 
identity theft.

Steve

---

From: Arshad Noor <[email-masked]>
Date: Tue, 06 Apr 2004 21:41:17 -0700

Stephen Kent wrote:

> My suggestion 
> is that the IMPACT of an identity theft incident would be worse if there 
> are fewer credentials (e.g., certs) associated with an individual, 
> rather than more. That notion is based on the assumption, stated 
> elsewhere, that when we have more credentials, each has a narrower scope 
> than if we have fewer, and thus the impact of a compromised credential 
> is less severe.
> 
	Taken to its logical conclusion, an infinite number of
	credentials per entity must lead to minimal impact of an
	identity theft incident.  However, humans cannot be expected to
	deal with such mathematical elegance without becoming blithering
	idiots.  (Some of us just need a few Internet accounts to reach
	that state :-)).

	Therefore, there must be some optimal number between 1 and
	infinity that balances risk vs. the inconvenience of carrying
	mulitple credentials.  Once again, for lack of empirical
	evidence, the identity firewall concept advances seven as the
	optimal number.
	
> credentials for an individual, since other factors affecting the ease of 
> identity theft have to do with the procedures used to issue the 
> credentials, and the extent to which secondary [uses] for selected credentials 
> are condoned. In fact, secondary uses are a major factor in identity 
> theft, which is often more of a procedural failure than a technical, 
> credential failure. 

	My point exactly when I spoke of "inappropriate use of identity
	data".  However, in order to correct procedural failures, one
	must look at all elements of the process - including the
	technology and the data itself - and determine if that needs to
	be corrected with with the process.

That is also why one ought not assume that use of
> certs, as a specific form of credential, will eradicate identity theft.
> 
	To paraphrase you, Steve, "My comment said nothing about
	eradicating identity theft."  (I do not believe it can ever be
	eradicated - just made difficult enough to deter most people.)

	Given the range of options that are available to technologists
	today, balancing usability, cost and security, digital
	certificates coupled with external cryptographic tokens and a
	high-assurance issuance process, are an optimal solution.  As
	time goes by, it may very well not be so, but until I see
	something better, that is the position I hold.

Arshad Noor
StrongAuth, Inc.

---

From: Ed Gerck <[email-masked]>
Date: Tue, 06 Apr 2004 23:59:45 -0700

>         evidence, the identity firewall concept advances seven as the
 
There is no logic requiring a global optimum, or even the same
global optimum, for the number of credentials for all users and 
all uses at all times. Empirical evidence supports the assertion
that we all have a growing number of credentials with time,
including all the expired ones. Yes, expired credentials are 
useful. For example, as supporting evidence to issue a renewed 
credential and/or as a credential with less privileges.

In such context, the idea that "seven" might be a magical number
is already outdated ;-)

Cheers,
Ed Gerck

---

From: Stephen Kent <[email-masked]>
Date: Wed, 7 Apr 2004 09:51:17 -0400

At 9:41 PM -0700 4/6/04, Arshad Noor wrote:
>Stephen Kent wrote:
>
>>My suggestion is that the IMPACT of an identity theft incident 
>>would be worse if there are fewer credentials (e.g., certs) 
>>associated with an individual, rather than more. That notion is 
>>based on the assumption, stated elsewhere, that when we have more 
>>credentials, each has a narrower scope than if we have fewer, and 
>>thus the impact of a compromised credential is less severe.
>>

this is silly, almost to the point of being absurd. "Seven" as the 
optimal number sounds practically mystical.

>credentials for an individual, since other factors affecting the 
>ease of identity theft have to do with the procedures used to issue 
>the credentials, and the extent to which secondary [uses] for 
>selected credentials are condoned. In fact, secondary uses are a 
>major factor in identity theft, which is often more of a procedural 
>failure than a technical, credential failure.
>

This paragraph makes no sense. Your previous message explicitly 
talked about eradicating identity theft, yet you are backtracking 
here.

>	something better, that is the position I hold.

I too am in favor of the use of certs with private keys maintained in 
hardware tokens and a high assurance issuing process, when the 
resources being accessed warrant such measures. But, "optimal" is an 
inappropriate term when we have such a wide range of resources that 
people access.

Steve

---

From: Arshad Noor <[email-masked]>
Date: Wed, 07 Apr 2004 21:34:46 -0700

> optimal number sounds practically mystical.
	Anything fantastic appears mystical and absurd if the logic
	behind it is not evident.  Here's the rationale:

	Most people in industrialized nations will deal with companies,
	or agencies, in one or more of the following industries, at some
	point in their lives:

	1) Healthcare - at birth, immunizations, medicines, etc.;
	2) Education - for schools, colleges, professional associations;
	3) Financial - for banks, brokerages, credit unions, etc.
	4) Government - for taxes, permits, licenses, passport;
	5) Employer
	6) Retail/E-commerce - buy books, air tickets, flowers, etc.
	7) Miscellaneous & personal uses - Sign e-mails to attorney,
		or receive encrypted e-mails from accountant, etc.

	By demarcating credential use strictly along industry lines, one
	allows each industry to come up with whatever issuance process
	that will serve their industry, for any legal purpose within
	that industry, without affecting any other industry.

	People may wind up with more or less credentials than seven.  An
	attorney, working for herself may choose never to have an
	Employer credential; and not liking the whole e-commerce
	experience she never buys anything on the Internet.  She may
	well have only 5 credentials.  As a parts supplier to a major
	auto manufacturer, I may be given access to their Supply-Chain
	portal through a Partner credential, perhaps taking my number
	of credentials to eight.  If I supply to 5 auto manufacturers
	and all of them issue me credentials, I will wind up with 12
	credentials.

	At a macro level, the average will wind up being around seven,
	based on the usage pattern enumerated above.

> This paragraph makes no sense. Your previous message explicitly talked 
> about eradicating identity theft, yet you are backtracking here.
> 

	My first posting to the list (see attached) clearly stated that
	"I do not believe identity theft will ever be eradicated
	 regardless of the number of certs.".

> hardware tokens and a high assurance issuing process, when the resources 
> being accessed warrant such measures. But, "optimal" is an inappropriate 
> term when we have such a wide range of resources that people access.
> 
	Therein lies the fallacy of PKI - or any other authentication
	technology - today: implied authorization to use of resources
	based on the authentication credential!

	To me, the use of certs with private keys in hardware tokens and
	a high assurance process is good enough only to IDENTIFY the
	presenter of the credential.  I will still want to go through
	whatever number of business rules I choose, to determine whether
	the identified entity has the authorization to use the resource.

	I use the word "optimal" only to refer to the number of
	credentials needed to identify an entity across many industries;
	the term would be highly inappropriate when used in reference to
	authorizations.  I would expect an infinite number of rules to
	exist in the  business world, to accomodate for authorization
	policies that govern how a wide range of resources are used.

Arshad Noor
StrongAuth, Inc.

Subject: Re: PKI International Consortium
From: Arshad Noor <[email-masked]>
To: Stephen Kent <[email-masked]>
Cc: PKIX list <[email-masked]>
Date: Mon, 05 Apr 2004 23:27:56 -0700

Arshad Noor
StrongAuth, Inc.

---

From: Stephen Kent <[email-masked]>
Date: Fri, 9 Apr 2004 14:45:46 -0400

Arshad,

I'll respond to just one of your examples, so show why I think this 
is very unrealistic for most of the grouping you chose.

>	2) Education - for schools, colleges, professional associations;

there is no single source appropriate for all schools. elementary, 
high school, undergraduate, graduate, professionlal associations. 
each is potentially a valid issuer of a cert, just as each issues a 
paper credential attesting to graduation, professional certification, 
etc. thus, one would not acquire one cert associated with educational 
institutions, but several. so, here, as in most of the examples you 
cite, an individual would acquire several certs, not just one.

certainly any frequent traveller already knows how many distinct 
credentials he/she acquires. these are separate and each identifies 
you by an account number that is managed by the issuer, not by any 
travel-industry wide oversight organization.

in the financial sector, we also have separate credentials, each 
issued by a separate institution. there is no single organization 
that has oversight responsibility for all of these institutions, and 
smart people like to maintain separation to insulate themselves 
against bad behavior at any one of these institutions.

>	<SNIP>
>>
>>I too am in favor of the use of certs with private keys maintained 
>>in hardware tokens and a high assurance issuing process, when the 
>>resources being accessed warrant such measures. But, "optimal" is 
>>an inappropriate term when we have such a wide range of resources 
>>that people access.
>>

A public key cert PKC) may attest to identity and be used as an input 
to an ACL to determine authorization. Or, one may issue a PKC and 
include authorization info. Or one may issue a PKC and issue one or 
more ACs to provide authorization info. There is not one right way to 
achieve the goal of authorization. However, in practice, essentially 
every identity credential we issue that is of value, also happens to 
be an authorization credential as well. A driver's license is an 
authorization to drive a certain class of vehicle. An employee ID 
usually grants the employee access to basic employ facilities, 
generic employee discounts, etc.

The reality is that there is generally very little motivation for an 
organization to issue a credential that identifies a person, unless 
the issuer plans the use the resulting credential for some form of 
authorization, at least with regard to the issuer. TTP CAs are 
typically in the business of issuing identity credentials that don't 
match this model, but then I tend to think of them as anomalous 
anyway ;-)

Steve

---

From: Arshad Noor <[email-masked]>
Date: Fri, 09 Apr 2004 21:48:45 -0700

Ed Gerck wrote:
>  
> Empirical evidence supports the assertion
	
	I have nothing against the number of expired credentials, Ed;
	just the number of active credentials.  Expired certs are
	invisible to me, even if they're still lying around in my
	authentication token.

Arshad Noor
StrongAuth, Inc.

---

From: Arshad Noor <[email-masked]>
Date: Fri, 09 Apr 2004 23:27:12 -0700

It is unrealistic only if we accept status quo, Steve.  If we change
the operating conditions - based on reason - then reality changes.
I don't deny that it is an arduous task - but I do not accept that
it is impossible.

Please see other comments below.

Arshad Noor
StrongAuth, Inc.

Stephen Kent wrote:

> Arshad,
> 
> I'll respond to just one of your examples, [t]o show why I think this is 
> very unrealistic for most of the grouping you chose.
> 
> there is no single source appropriate for all schools. elementary, high 
> school, undergraduate, graduate, professionlal associations. 

	This is accurate.  However, there are a number of associations
	that represent such institutions - NEA, ITEA, AACSB, AMA, ABA,
	IEEE, IETF, etc. - that could have an influence amongst their
	members after they were convinced of the benefits.

	Once convinced, a small working group of representatives - one
	for the Elementary school, one for the Middle school, for High
	School, Undergraduate, Graduate school and a Professional
	Association - could create the technical and business standards
	necessary (with some support from members of this august forum).

	Much like individuals participate in the creation of IETF
	standards (as in this forum), so will these associations through
	their representatives.  Will it take time?  Definitely.  Will it
	please everybody?  Definitely not.  But will a standard come out
	of it?  Almost certainly, if the working group is dedicated.

each is
> potentially a valid issuer of a cert, just as each issues a paper 
> credential attesting to graduation, professional certification, etc. 
> thus, one would not acquire one cert associated with educational 

	I would not recommend the issuance of a cert to attest to one's
	graduation or professional certification. The business objective
	is that someone needs to verify that you truly graduated from
	some school.  There are many simpler ways of accomplishing this:

	1) A secured website that would provide the unique cert DN, the
	   educational qualification and year of graduation to anyone
	   that wanted to view it; alumni that would rather not have
	   this information visible on the Internet could opt out of
	   this type of service, and go with #2;

	2) An asynchronous e-mail service that would send a signed
	   e-mail to the RP, from the alma mater, providing the above
	   information at the individual's request, AFTER having
	   authenticated him by his Education credential and having
	   duly determined his authorization to make such a request;

	3) A synchronous web-service available to anyone that requested
  	   the information; those alumni that would rather not have this
	   information sent out unless they authorized it, could opt out
	   of this type of service, and stay with #2;

	I am sure there are many other ways that members of this forum
	could solve this business problem, in addition to the above.

	In this manner, you end up issuing a single credential to serve
	an individual's needs in the Education industry from KG to Ph.D.
	and still attest to RP's about the individuals' educational
	qualifications without issuing additional certs.

	(Similar response for the travel and financial industry examples
	you provided.)

> A public key cert PKC) may attest to identity and be used as an input to 
> an ACL to determine authorization. Or, one may issue a PKC and include 
> authorization info. Or one may issue a PKC and issue one or more ACs to 
> provide authorization info. There is not one right way to achieve the 
> goal of authorization. However, in practice, essentially every identity 
> credential we issue that is of value, also happens to be an 
> authorization credential as well. A driver's license is an authorization 
> to drive a certain class of vehicle. An employee ID usually grants the 
> employee access to basic employ facilities, generic employee discounts, 
> etc.
> 
	I agree with you.  Even in my own example to Anders yesterday, a
	Financial Industry credential without any accounts associated
	with it, still has the implicit authorization to open a new
	account, if desired, at supporting institutions.

	To some extent, every industry group will probably associate
	some base level of authorization to the industry-specific
	identity; BUT since it serves just that industry, they reap the
	benefits, or pay for the consequences of their good or short-
	sighted	decisions, if any.

> organization to issue a credential that identifies a person, unless the 
> issuer plans the use the resulting credential for some form of 
> authorization, at least with regard to the issuer. 

	If the issuer were a "super-association" for an industry, as
	opposed to a company within the industry or an association
	representing a segment of the industry, then there are huge
	cost savings to everyone in the industry - as well as the
	consumer they serve.  That will be the motivation; and I hope
	to document this in my treatise.

---

From: "Anders Rundgren" <[email-masked]>
Date: Sun, 11 Apr 2004 10:47:10 +0200

Arshad,

>Steve Kent wrote:

>cite, an individual would acquire several certs, not just one.

Although I hardly ever agree with Steve, he is correct.  I think
the same is even more valid for industrial segments where it
is likely to be impossible to raise money for running top CAs,
cross-certify, or even creating a common certificate policy.

What Steve did not mention, is that the authentication and
authorization schemes that are firmly in place since three
decades or so for bank-to-bank and supplier-to-manufacturer
networks, together with recent developmemts like SAML and
3D Secure, will likely forever change how PKI is applied, which
also will affect schemes like the Identity Firewall.

>match this model, but then I tend to think of them as anomalous 

Probably PKI deployment will follow two main directions,
relying-party-only and general purpose TTPs.  Which one
will be dominating depends IMHO not on technical
issues but on business models and costs.  There are to my
knowledge practically no limitations to what you can do
with an identity credential using indirect auth* schemes.

Indirect auth* schemes BTW offer huge cost, control, and
scalability advantages over the schemes currently being
deployed by many public sector PKI programs.

Anders

---

From: Stephen Kent <[email-masked]>
Date: Mon, 12 Apr 2004 09:55:31 -0400

>I don't deny that it is an arduous task - but I do not accept that

I would not say that it is impossible, just highly unlikely and not 
very desirable.

I won't bother boring the list with responses to each of your 
comments.  If you believe this is both a feasible and desirable 
outcome, and want to convince others, then you should write papers 
that are peer reviewed and published, to demonstrate that you are not 
alone in this view.  Web pages published by oneself or one's company 
are merely advertisements and warrant no serious consideration in a 
debate like this.

Steve