Subject: [pkng] some thoughts

From: Leif Johansson <[email-masked]>
Date: Thu, 12 Nov 2009 05:27:28 +0100

This is a loose bunch of ideas and thoughts spurred by todays
discussion. I'll probably come up with more later.

I'm using the term 'key consumer' loosely to describe something
that interacts with PKNG using PKNG keys whatever that is... Maybe
that should be trust consumers but whatever...

1. bottoms up vs top down

In PKIX the key relationship is between the key and the CA. I
believe PKNG should turn this around and be designed based on the
relationship between the key and the key consumer.

I'm consciously trying to avoid using terms like user-centric or
user-managed since they evoke images of specific technologies or
patterns and in fact I'm thinking about the RPKI and the KARP
when writing this.

2. assurance is not an enum

The strength or assurance of a relationship (as represented by
a key exchange) probably shouldn't be a discrete set of values
(trusted or not, QC or not, or LoA 1-4 or whatever).

In analogy with BGP, key consumers should be able to express
rich policy for when to use a key for a particular transaction
based on access to a parameter space that might encompass some
of Lucys 'set-of-interactions' idea.

For instance I'd like to be able to bootstrap my local trust
parameter space from both physical interactions (our RFID
thingamajigs touched) or virtual interactions (I saw an email
signed by that key)

3. BGP of trust

In analogy with networking I'd like PKNG to become the "routing
layer" for trust. Specifically I believe it should be a non-goal
of PKNG to even be able to express a single hierarchy of trust
for the Internet :-)

I believe that PKIX was built on technology designed to be
deployed as _the single_ hierarchy of trust but it is in fact
being deployed as a set of islands of trust. By contrast I
think PKNG should be designed to interconnect multiple
realms of trust.

This is partly what I was getting at when I said that PKNG
should be designed with 'bridges turned on by default' at the
meeting today.

	Cheers Leif

---

From: Peter Saint-Andre <[email-masked]>
Date: Fri, 13 Nov 2009 14:35:41 +0900

> patterns and in fact I'm thinking about the RPKI and the KARP

Leif, I skimmed your email while I was sitting in the DTNRG session this
morning, so the mention of bottom up rang a bell. PKI is impossible when
there is no "I" to be had (distressed networks, ad-hoc meshes, etc.). As
people carry more and smaller personal devices, they might want to
exchange information directly in their interactions (beamed, radioed,
etc.). They won't necessarily have access to canonical sources of trust
located in hierarchies or roots. Further, they might not *care* about
hierarchical trust, instead putting a higher value on bottom up or peer
to peer trust. Perhaps trust will be based more on social networking and
personal interconnections (think IM buddy lists, LinkedIn, Facebook,
Twitter). Keys and certs (or whatever we end up calling them) are cheap,
so people might generate new ones when needed (or for different
purposes), check credentials with people or entities in their network
only when they interact with a person, etc. We have ways to push this
information out (hey everyone, I've got a new keything) and for
performing on-demand checks (hey Leif, Paul says his keything has a
print of foo, is that consistent with what you know?).

Just a few random ideas generated on the Nozomi train out of Hiroshima... :)

Peter

--
Peter Saint-Andre
https://stpeter.im/

---

From: Leif Johansson <[email-masked]>
Date: Sat, 14 Nov 2009 22:56:56 +0100

> Just a few random ideas generated on the Nozomi train out of Hiroshima... :)

Yeah this is how I think about it too - to buzz a word: crowdsourcing
identity (but we'll have to be careful not to build another pgp that
doesn't have a business model).

	Cheers Leif

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 17 Nov 2009 11:37:07 -0700

> doesn't have a business model).

Despite my libertarian rhetoric, I'm not absolutely opposed to (some)
hierarchies. Perhaps what I'd like to see is an approach that is not
exclusively hierarchical (PKI with the focus on "I") or exclusively
peer-to-peer (PGP), but instead an approach in which there can be many
input sources. Some of those sources might be privileged or weighted
more highly by some participants. And perhaps this is not all that
different from PKI (I don't trust all CAs) or even PGP (I don't care if
some random person has signed your key, only people I know about or have
some trust in). Unfortunately I think that X.509/PKI and PGP/WoTs have
been presented and deployed as two diametrically opposing approaches.
I'd like to see us reach some harmony between the two concepts...

Peter

-- 
Peter Saint-Andre
https://stpeter.im/