Subject: Re: e2e security (was Re: stats from the text conferencing experiment)

From: "Steven M. Bellovin" <[email-masked]>
Date: Mon, 25 Nov 2002 20:56:40 -0500

In message <[email-masked]>, Randy Bush writes:
>> The IETF list is NOT an example of an easy context in which to use 
>> signed messages. it is not a closed list within a company where a 
>> single CA might issue all the certs to users and a central IT 
>> organization might be able to ensure that all mail clients had S/MIME 
>> capability.
>
>good.  because i find the hierarchic and centralized control model
>unsuited to much of what i want to do on the internet.  pfui on CAs,
>centralized IT departments, and the like.
>
>pem is one of the ideas that did not fly.  try pgp or some similar
>non-centralized model.

It isn't a matter of PGP vs. S/MIME -- it's a question of whom do you 
trust to authorize the function.  We clearly don't need one root with 
Steve Coya running the CA.  We don't even need one per area, with the 
ADs as roots.  A hierarchy per wg, with keys signed by the chairs or 
list maintainer?  Maybe -- but then it's a hassle when you join a new 
group.

I can stare at a PGP graph and decide if I want to trust the key or 
not.  It's rather harder to automate that.

		--Steve Bellovin, http://www.research.att.com/~smb (me)
		http://www.wilyhacker.com ("Firewalls" book)

---

From: Dean Willis <[email-masked]>
Date: 25 Nov 2002 22:10:10 -0600

> not.  It's rather harder to automate that.

Consider that we don't REALLY need e2e security -- we really need e2M
security, where the M is the majordomo system.

You don't need different rights for areas or working groups. It would be 
adequate to have a single trust realm -- basically, anybody with an
IETF cert could post to any IETF list or subscribe to any IETF list
without bothering the list moderator. Anybody who doesn't use a key 
bothers the moderator, who then decides whether to accept, reject, or 
help the individual get a cert.

So when the IABer makes an architectural comment to a list they don't 
want to subscribe to, the post sails right through. When a spammer 
or a newbie posts, it goes to the moderator (who gets to decide which
is which).

It shouldn't be all that hard to cobble up a rough introducer-mechanism 
for Open-SSL. So, let's say Steve introduces the ADs. The ADs introduce
their chairs. The chairs introduce some sidekicks who introduce the 
working group participants. Once we hit saturation, it gets much easier.

PGP does this more cleanly, but we don't really need the web-of-trust
to do this, just a log file on the key server so the secretariat could
track an abuser, were we to get one. Besides, I can't even get the
Enigmail plug-in in my Mozilla to talk to Evolution on this PC. They 
both use GnuPG, but have different and incompatible MIMEs.

We'd need a little policy about revocation, but it should be fairly 
straightforward.

It's not PERFECT security, but is it good enough for a jump-start?

--
Dean

---

From: "Jeffrey I. Schiller" <[email-masked]>
Date: Mon, 25 Nov 2002 22:56:33 -0500

Its not about PGP vs. S/MIME or hierarchies vs. Web of Trust. It is
about ease of use.

There are just too many e-mail clients out there for us to "win" on
this one. Sad as that is. The e-mail situation is out of our hands,
and in the hands of the software vendors. We cannot have
signed/encrypted e-mail until the deployed e-mail solutions make it
trivial for the average person to participate. Both Netscape and
Internet Explorer support S/MIME. It is even possible to get a
credential issued by a well known CA, you just have to go to the right
webpage (which the browsers will direct you to) and pay some money
(oops).

Still, we don't have it. Why?

o People don't know it exists (the software certainly doesn't
   highlight this feature).
o People don't perceive the need for it, e-mail works fine without it.
o The implementations are still not easy enough to use.
o Finally in order to have benefit, a large number of people need to
   use it, and that is hard.

Frankly to be deployable these days security technology will have to
be:

1. Easy to use, very easy. Maybe transparent to the end-user.
2. Cost effective. Close to free!
3. Incrementally deployable. There needs to be a win, even if all of
    your friends don't follow your example.

This is a tall order!

It is also much easier to deploy security if we get it in the first
versions. So whereas e-mail may be a lost cause, a new instant
messaging system such as xmpp (aka Jabber) isn't (yet).

I use the "Gabber" Jabber client. It implements SSL/TLS connections
between client and server. Does it solve all security problems in
Jabber? No. But it is a big help. I get confidentiality between my
client and the server, by simply checking a box in the client (the
server operator has a bit more work to do, but frankly balancing the
workload with more on the server is better, the server operator has a
higher chance of being clued then the client end-user). Gabber also
supports end-to-end security in direct person to person messages if
both end-users have GPG installed and know how to set it up. So if I
want to invest the effort, I can get end-to-end security.

The challenge to us now is to make this end-to-end security setup as
simple as possible.

Just one way this can be done:

o Have the GPG functionality built into the client, so it is there all
   the time.
o Have part of the server registration process involve the generation
   of a GPG key with an appropriate name, signed by the server.
o If server operators sign each other's keys, then a web of trust is
   possible, but this isn't necessary to get some amount of end-to-end
   privacy.

This would be a real cool first step. Again, the key is incremental
deployment, ease of use, the right price (can you say "free").

It can be done... we just have to do it.

                         -Jeff

---

From: Bill Fenner <[email-masked]>
Date: Wed, 27 Nov 2002 10:57:09 -0800

>...

Should we publish the 45,000 clear-text email messages that crossed
the Internet link at the Atlanta IETF meeting?

  Bill

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Wed, 27 Nov 2002 14:15:02 -0800

>the Internet link at the Atlanta IETF meeting?

Boy, making threats like that will sure make us popular!

IMC has worked with corporate Internet mail users for the past seven 
years, and these folks fully understand what "not encrypted" means. 
Most of them use systems that already can encrypt email, at some 
penalty for the hassle factor. Virtually all of them have chosen not 
to, mostly due to the hassle factor. Any industry that has real 
privacy needs is already using secure mail. Essentially none said 
that they needed authenticated mail. Anything that comes in mail, 
even digitally signed mail, that needs to be authenticated is 
followed up with a phone call or a fax.

Standards-based secure email has been available for many years, and 
almost no one wants it. Please do not interpret that fact as "we 
should try to scare them into using it." At best, you can interpret 
it as "the applications vendors have not done a good job of making 
this friendly enough for people to want ot use it."

(Yes, Bill possibly meant to put a smiley face at the end of his 
suggestion, but he didn't. And there are *plenty* of people in the 
Security Area who seriously propose doing things like this almost 
every IETF meeting.)

--Paul Hoffman, Director
--Internet Mail Consortium

---

From: "Theodore Ts'o" <[email-masked]>
Date: Wed, 27 Nov 2002 19:30:01 -0500

> Still, we don't have it. Why?

The PGP vs. S/MIME divide is also a very important reason why e-mail
encryption isn't widely deployed.  Right now, the "lead adopters" of
the technology are primarily using PGP/GPG.  The IETF PGP key signing
parties still get a respectable attendance, although not what it was
3-4 years ago (although I suspect that's because many of the core
IETF'ers have already cross-certified each other).  The Debian
distribution has its own web of trust to which you must be certified
before you can become a Debian Developer and upload GPG-signed binary
packages which will be used by Debian users all over the planet (a
good thing, most people would agree).  I'm told that the FIRST and
various CERT teams use PGP-signed messages to communicate with each
other.  Furthermore, the Unix-based e-mail clients, especially the
open-source ones, pretty much all have PGP/GPG integration.

But Netscape's mail reader, MS Outlook, etc. support S/MIME instead.
So the majority of the e-mail users out there have clients out there
support S/MIME, and *not* PGP.  Worse yet, I'm not aware any open
source implementation for S/MIME, except for Mark Riorden's RIPEM, and
that appears to be abandoned.  Certainly "apt-cache search s/mime"
doesn't turn up anyhing; neither did any google searches.  So right
now, even if I wanted to use S/MIME, I don't think I could.

So with the mail clients which cater to the "easy of use" crowd ---
the all-important mass market --- using one encryption standard, and
the sophisticated users who can figure out how to do email crypto
using a completely different encryption standard, is it no wonder that
the adoption of secure e-mail has stalled?  

> messaging system such as xmpp (aka Jabber) isn't (yet).

I fear instant messaging has a similar problem to the S/MIME vs. PGP
problem, except at least twice as worse.  Right now, depending on who
I want to talk to, I have to use one of the following instant
messaging/chat systems:

	* MIT/Athena Zephyr
	* IBM/Lotus Sametime
	* IRC (I need to connect to at least two separate IRC
		networks: LinuxNet and OpenProjects)
	* Jabber
	* AOL Instant messager

Some of these (Zephyr, Sametime, Jabber) have security --- all
incompatible with each other and using different credentials, but they
have security.  Others (especially IRC) do not.

Right now, I've given up hope that these many desperate systems will
ever be merged into a single system, and am just hoping to find a
single client that can multiplex between all of these systems
seamlessly.....

						- Ted