Subject: I-D ACTION:draft-ietf-spki-cert-theory-00.txt

From: [email-masked]
Date: Mon, 01 Dec 1997 13:17:36 -0500

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Simple Public Key Infrastructure Working Group of the IETF.

	Title		: SPKI Certificate Theory
	Author(s)	: B. Lampson, R. Rivest, B. Frantz, C. Ellison, 
                          B. Thomas, Y. Ylonen
	Filename	: draft-ietf-spki-cert-theory-00.txt
	Pages		: 30
	Date		: 26-Nov-97
	
   The SPKI Working Group has developed a standard form of digital
   certificate that is both more general and simpler than what is
   traditionally considered to be a certificate.  Since the word
   ''certificate'' was first used by Loren Kohnfelder in 1978 to refer to
   a signed record holding a name and a public key, it has been assumed
   that the only purpose of a certificate has been to bind a public key
   to a globally unique name and therefore to a person.  This binding
   was assumed both necessary and sufficient for security.
 
   The working group has found that the creation of a globally unique
   name is neither necessary nor sufficient for Internet security or
   electronic commerce.  In fact, use of global names can introduce a
   security flaw.  Therefore, we define certificate forms for binding
   local names to keys (to retain security while offering the
   convenience of meaningful names) and for assigning authorizations to
   keys (to provide adequate information for real applications).  These
   forms can be used alone or together.

Internet-Drafts are available by anonymous FTP.  Login with the username
"anonymous" and a password of your e-mail address.  After logging in,
type "cd internet-drafts" and then
	"get draft-ietf-spki-cert-theory-00.txt".
A URL for the Internet-Draft is:
ftp://ds.internic.net/internet-drafts/draft-ietf-spki-cert-theory-00.txt

Internet-Drafts directories are located at:

	Africa:	ftp.is.co.za
	
	Europe: ftp.nordu.net
		ftp.nis.garr.it
			
	Pacific Rim: munnari.oz.au
	
	US East Coast: ds.internic.net
	
	US West Coast: ftp.isi.edu

Internet-Drafts are also available by mail.

Send a message to:	[email-masked].  In the body type:
	"FILE /internet-drafts/draft-ietf-spki-cert-theory-00.txt".
	
NOTE:	The mail server at ds.internic.net can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: Ed Gerck <[email-masked]>
Date: Thu, 4 Dec 1997 14:02:53 -0200 (EDT)

On Mon, 1 Dec 1997 [email-masked] wrote:

- -> A New Internet-Draft is available from the on-line Internet-Drafts
- -> directories.  This draft is a work item of the Simple Public Key
- -> Infrastructure Working Group of the IETF. 
- -> 
- -> 	Title		: SPKI Certificate Theory
- -> 	Author(s)	: B. Lampson, R. Rivest, B. Frantz, C. Ellison, 
- ->                           B. Thomas, Y. Ylonen
- -> 	Filename	: draft-ietf-spki-cert-theory-00.txt
- -> 	Pages		: 30
- -> 	Date		: 26-Nov-97
- -> 	

I think that the document has serious flaws and should be ammended, as
well as the name SPKI no longer reflects the result of the merge with
SDSI. Specifically, my comments are given below for each point.

- ->    The SPKI Working Group has developed a standard form of digital
- ->    certificate that is both more general and simpler than what is
- ->    traditionally considered to be a certificate.  Since the word
- ->    ''certificate'' was first used by Loren Kohnfelder in 1978 to refer to
- ->    a signed record holding a name and a public key, it has been assumed
- ->    that the only purpose of a certificate has been to bind a public key
- ->    to a globally unique name and therefore to a person.  This binding
- ->    was assumed both necessary and sufficient for security.

This last phrase is wrong, because X.509 (the standard alluded to, and
mostly used) does not say so or assumes it. Here, there are actually three
entities and respective bindings: key, name, person.  The definitions of
key, name and their binding are handled by X.509, whereas the binding of
either with a person (and a person's qualifications) are handled by the
CA's CPS -- which is outside the scope of X.509. The same happens for PGP.

Thus, current certificates do not assume that such bindings (plural, here) 
are necessary and sufficient for security -- on the contrary, certificates
such as X.509 and PGP just provide for a security framework to be reached
as a function of the various CPSs and how they are to be interpreted by
each verifier. 

Further, X.509 (and PGP) clearly lay out several purposes besides name
binding for certificates, as given by the extensions in X.509v3, including
authorizations such as the possibility to be used as a root-cert for
signing other certs, etc. 

- ->  
- ->    The working group has found that the creation of a globally unique
- ->    name is neither necessary nor sufficient for Internet security or
- ->    electronic commerce.  In fact, use of global names can introduce a
- ->    security flaw.  

This is plain wrong. If globally unique names can be defined then it is a
sufficient condition (together with other suitable conditions for the
public-key, etc.) to uniquely define the agents of actions, globally. This
has nothing to do with the fact that a globally unique name cannot be
defined with current technology, in the general case. In fact,
counter-paraphrasing the last phrase above, use of global names (that
deserve the name) could never introduce security flaws! 
                                         
- -> Therefore, we define certificate forms for binding
- ->    local names to keys (to retain security while offering the
- ->    convenience of meaningful names) and for assigning authorizations to
- ->    keys (to provide adequate information for real applications).  These
- ->    forms can be used alone or together.
- -> 

Of course, local names can only be locally meaningful and must be always
isolated from any global context (where they may even collide) -- which
makes them useless in a world PKI.

To further discuss the issues, I assume that for the SPKI proposal there
is no identity other than the key, so there is no entity authentication,
just key authentication and all actions are performed in cyberspace. For
SDSI, I assume that there is no identity of meaning to anyone other than
to the CA, so all entities's names are only locally valid and all actions
are again performed in cyberspace. 

So, as SPKI was merged with SDSI, SPKI had indeed to consider all names to
be local -- which essentially: 

(i) gives up the hope of any binding between cyberspace entities and
real-world legal or accountable entities, and

(ii) takes away the "Infrastructure" aspect of the SPKI name.

(These problems are not to be solved by SPKI, but by a "subpoena
certificate" as Carl Ellison has named it, which is a service to be paid
for by the user and which will be treated in the future. Which has nothing
to do with the SPKI proposal and which certainly brings up problems of its
own.) 

Thus, I fail to see where SPKI/SDSI would offer a better situation than
X.509, regarding any security goal for the worldwide Internet. In fact,
SPKI take away any possible semantics that could be offered by a CA's CPS,
in order to resolve naming conflicts or assignments in a global scale. The
"may delegate" flag in SPKI is another open question, where anyone may
fake a cert with an authorization for the key of another person (a framing
attack).  Further, SPKI wrongly considers trust to be fully transitive and
distributive -- for which, X.509 and PGP at least offer a partial way out.
                                                                  
Thus, the SPKI proposal should refrain from making misleading statements
on global names and should also delete the words "Public-Key
Infrastructure" from its name because it only deals with local names --
which, of course, will never allow a PKI to be built. The local names of
"SPKI/SDSI" are forever local and have no significance outside their local
trust domain. 

Yours,

Ed

______________________________________________________________________
Dr.rer.nat. E. Gerck                        [email-masked]
http://novaware.cps.softex.br
P.O.Box 1201, CEP13001-970, Campinas-SP, Brazil

---

From: "Flanigan, Bill" <[email-masked]>
Date: Fri, 5 Dec 1997 16:22:00 -0500

Ed,

     Your comments are most germane--and timely.  I just can't 
envision how passing the "binding buck" solves anything.

     In the legal scheme of things, somewhere 3D space MUST be firmly 
linked to cyberspace.  That is, if SPKI is to be taken seriously--like 
for "industrial-strength" electronic commerce.

     No matter how you slice or dice it, the irony remains:  the 
analog world is the real (and ultimate) infrastructure for the digital 
world--at least for any transaction over, say, $25.00!

     Comments?

Bill Flanigan

______________________________ Reply Separator
_________________________________
Subject: RE: Re: I-D ACTION:draft-ietf-spki-cert-theory-00.txt
Author:  Ed Gerck [SMTP:[email-masked]]  at DISAHUB
Date:    12/4/97 11:02 AM

...

So, as SPKI was merged with SDSI, SPKI had indeed to consider all names
to
be local -- which essentially:

...

(These problems are not to be solved by SPKI, but by a "subpoena
certificate" as Carl Ellison has named it, which is a service to be paid
for by the user and which will be treated in the future. Which has
nothing
to do with the SPKI proposal and which certainly brings up problems of
its
own.)

...

Yours,

Ed

---

From: Ed Gerck <[email-masked]>
Date: Fri, 19 Dec 1997 13:53:56 -0200 (EDT)

On Tue, 16 Dec 1997, Flanigan, Bill wrote:

Bill:

Thanks for your comment. 

One of the  problems is also about assumptions -- unwarrranted. For
example, when SPKI says "Bob authorizes Alice"  what it is really saying
is that " 7A51D8... authorizes C39A04..."  because "names"  in SPKI are
keys ... So, there is no Bob or Alice and the impression that you are
actually binding that authorization to a person is, in the least,
misleading in the SPKI texts. Why say Bob when you don't mean Bob?

Cheers,

Ed

-> ------------------------------------------------------------------------
-> Microsoft Mail v3.0 (MAPI 1.0 Transport) IPM.Microsoft Mail.Note
-> From: Flanigan, Bill
-> To:  [email-masked]
->      Ed Gerck
-> Cc:  Flanigan, Bill
-> Subject:  RE: I-D ACTION:draft-ietf-spki-cert-theory-00.txt
-> Date: 1997-12-05 16:22
-> Priority: 3
-> Message ID: 9DE52F643E6DD111ABC70020AFCC3DA8
-> 
-> 
-> 
-> 
-> Ed,
-> 
->      Your comments are most germane--and timely.  I just can't
-> envision how passing the "binding buck" solves anything.
-> 
->      In the legal scheme of things, somewhere 3D space MUST be firmly
-> linked to cyberspace.  That is, if SPKI is to be taken seriously--like
-> for "industrial-strength" electronic commerce.
-> 
->      No matter how you slice or dice it, the irony remains:  the
-> analog world is the real (and ultimate) infrastructure for the digital
-> world--at least for any transaction over, say, $25.00!
-> 
->      Comments?
-> 
-> Bill Flanigan
-> 
-> 
-> ______________________________ Reply Separator
-> _________________________________
-> Subject: RE: Re: I-D ACTION:draft-ietf-spki-cert-theory-00.txt
-> Author:  Ed Gerck [SMTP:[email-masked]]  at DISAHUB
-> Date:    12/4/97 11:02 AM
-> 
-> ...
-> 
-> So, as SPKI was merged with SDSI, SPKI had indeed to consider all names
-> to
-> be local -- which essentially:
-> 
-> (i) gives up the hope of any binding between cyberspace entities and
-> real-world legal or accountable entities, and
-> 
-> ...
-> 
-> (These problems are not to be solved by SPKI, but by a "subpoena
-> certificate" as Carl Ellison has named it, which is a service to be paid
-> for by the user and which will be treated in the future. Which has
-> nothing
-> to do with the SPKI proposal and which certainly brings up problems of
-> its
-> own.)
-> 
-> ...
-> 
-> Yours,
-> 
-> Ed
-> 
-> ______________________________________________________________________
-> Dr.rer.nat. E. Gerck                        [email-masked]
-> http://novaware.cps.softex.br
-> P.O.Box 1201, CEP13001-970, Campinas-SP, Brazil
-> 

______________________________________________________________________
Dr.rer.nat. E. Gerck                        [email-masked]
http://novaware.cps.softex.br
P.O.Box 1201, CEP13001-970, Campinas-SP, Brazil  - Fax: +55-19-2429533

---

From: "Flanigan, Bill" <[email-masked]>
Date: Tue, 16 Dec 1997 11:55:00 -0500

------------------------------------------------------------------------
Microsoft Mail v3.0 (MAPI 1.0 Transport) IPM.Microsoft Mail.Note
From: Flanigan, Bill
To:  [email-masked]
     Ed Gerck
Cc:  Flanigan, Bill
Subject:  RE: I-D ACTION:draft-ietf-spki-cert-theory-00.txt
Date: 1997-12-05 16:22
Priority: 3
Message ID: 9DE52F643E6DD111ABC70020AFCC3DA8

Ed,

     Comments?

Bill Flanigan

...

...

...

Yours,

Ed