Subject: Re: WG Last Call on draft-ietf-pkix-tac-03

From: Stephen Kent <[email-masked]>
Date: Mon, 4 May 2009 09:31:28 -0400

At 2:56 PM +0100 4/2/09, Stephen Farrell wrote:

Stefan Santesson wrote:

> The authors of Traceable Anonymous Certificate

> draft-ietf-pkix-tac-03.txt has requested WGLC.

> http://tools.ietf.org/html/draft-ietf-pkix-tac-03

A couple of comments:

#1: Top of p7:

"To effect issuance of the TAC, the AI interacts with

the BI, over a secure channel, to jointly create the
signature on

the TAC, and sends the signed TAC to the user.

The AI does this without learning the user's real
identity

(either from the user or from the BI)."

If the AI sends the TAC to the user, then it will know some

form of identity for that user, even if that's only an IP

address. (And with the likes of SAVI, that could well be

enough to establish a real
identity.)

We already note in the Security Considerations section that the
anonymity guarantees offered by the TAC model may be undermined by
lower layer protocol info of this sort.

It
also may be possible to determine the identity of a user via
information

carried by lower level protocols, or by other, application-specific
means.

For
example, the IP address of the user might be used to identify
him/her.

So, this is not a new concern and I think it is adequately
addressed by the current Security Considerations text.

I'd have thought it'd be much better to
return the TAC

via the BI and not require any
user<->AI direct connections?

The BI knows the user's true identity, but is not supposed to
know the ID that appears in the Subject field of the TAC (or the rest
of the cert content). So, the BI cannot hand the cert back to the user
in plaintext form.

#2: Section 5.2 claims that the AI can't unilaterally fool

the BI into revealing the real identity. But the only thing

that stops that seems to be the RP client identity verified

by the BI when the RP establishes a mutual-auth TLS connection

to the BI.

So how can the BI really know that its not the AI making
that

connection?

Yes, it is the two-way authenticated TLS connection via which the
identity is revealed that is intended to prevent the AI from
requesting the  user ID unilaterally. There is an assumption
(that we can make explicit) that the cert issued to the RP (typically
a web site) was issued by an independent CA, not affiliated with the
TAC.

Steve