Subject: Re: e2e security (was Re: stats from the text conferencing experiment)

From: "Steven M. Bellovin" <[email-masked]>
Date: Mon, 25 Nov 2002 23:03:56 -0500

In message <[email-masked]>, Dean Willis writ
es:
>
>> 
>> It isn't a matter of PGP vs. S/MIME -- it's a question of whom do you 
>> trust to authorize the function.  We clearly don't need one root with 
>> Steve Coya running the CA.  We don't even need one per area, with the 
>> ADs as roots.  A hierarchy per wg, with keys signed by the chairs or 
>> list maintainer?  Maybe -- but then it's a hassle when you join a new 
>> group.
>> 
>> I can stare at a PGP graph and decide if I want to trust the key or 
>> not.  It's rather harder to automate that.
>
>Consider that we don't REALLY need e2e security -- we really need e2M
>security, where the M is the majordomo system.
>
>You don't need different rights for areas or working groups. It would be 
>adequate to have a single trust realm -- basically, anybody with an
>IETF cert could post to any IETF list or subscribe to any IETF list
>without bothering the list moderator. Anybody who doesn't use a key 
>bothers the moderator, who then decides whether to accept, reject, or 
>help the individual get a cert.

A single trust realm is, more or less, a singly-rooted CA, which is 
exactly what Randy wants to get away from.
>
>So when the IABer makes an architectural comment to a list they don't 
>want to subscribe to, the post sails right through. When a spammer 
>or a newbie posts, it goes to the moderator (who gets to decide which
>is which).
>
Or perhaps the moderator adds the key to the IETF-wide approved list.

>PGP does this more cleanly, but we don't really need the web-of-trust
>to do this, just a log file on the key server so the secretariat could
>track an abuser, were we to get one. Besides, I can't even get the
>Enigmail plug-in in my Mozilla to talk to Evolution on this PC. They 
>both use GnuPG, but have different and incompatible MIMEs.

See Jeff Schiller's comments about implementations and usage...
>
>We'd need a little policy about revocation, but it should be fairly 
>straightforward.
>
Especially when someone gets suspended from a list...

		--Steve Bellovin, http://www.research.att.com/~smb (me)
		http://www.wilyhacker.com ("Firewalls" book)

---

From: Randy Bush <[email-masked]>
Date: Mon, 25 Nov 2002 21:52:14 -0800

send in your public pgp key when you su_bscribe.  if it is not
signed by someone already su_bscribed (or in the mailing list
host's super ring, then the su_bscription request goes to the list
owner.

randy