Subject: RE: Software for PKI

From: "Harrington, Chris" <[email-masked]>
Date: Tue, 6 Nov 2001 14:25:56 -0500

>>Finally, we seem to be making progress in getting signatures and
certificates
>>sufficiently accesible for the average citizen to start actually using!

>Is this of any value if they're mostly worthless?

It is absolutely of value if you want mass market acceptance of PKI. By your
own statement the user will pick the "pretty" application over the
functional one. Instead of shouting at the rain about how insecure MS CAPI
may or may not be, we should concentrate on developing some PKIX / RFC
compliant apps that give the users that "warm and fuzzy" feeling. 

Thoughts??

Chris

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Saturday, November 03, 2001 1:26 AM
To: [email-masked]; [email-masked]; [email-masked]
Subject: RE: Software for PKI

Peter Williams <[email-masked]> writes:

>"Probably the finest" set of simple-to-use PKI (PKIX-I -complying
cert-based)
>programs for making/verifying digital signatures probably comes from two of
>the most used and "usable" consumer programs in the world, fortunately:
>Microsoft Office 2000, and PKZip - from a maker of the infamous zip format
for
>compressing sets of files into an archive file.

The problem is that what you're getting with Windows isn't PKIX, it's MSIX.
The list of bugs in MS's certificate handling alone (in the X.509 style
guide)
is about the same size as that for all other vendors combined, and that
doesn't
go into all the bugs and quirks of CAPI which affect public and private key
use, signing, and other things (but which don't really have much place in
the
style guide so they're not listed there).

It may be easy to use, and you may get wonderful warm fuzzies from it, but I
wouldn't put any trust in the result.  It's the usual choice for users, do
you
want something you can place some trust in, or do you want something which
looks pretty?  (Unfortunately in most cases it's the latter, but I can't do
much about that except try and educate the masses).

>It all makes testing PKI(X) really easy.

But what you're testing isn't anything like PKIX, it's MSIX.  If you want to
test interoperability with other instances of the Windows PKI then it's
fine,
but to test PKIX capabilities you'll need to use something which actually
follows the PKIX RFCs and drafts.

>Finally, we seem to be making progress in getting signatures and
certificates
>sufficiently accesible for the average citizen to start actually using!

Is this of any value if they're mostly worthless?

Peter.

-----BEGIN CERTIFICATE-----
MIIQojCCCIoCAQAwDQYJKoZIhvcNAQEEBQAwGDEWMBQGA1UEAxMNS29tcGxleCBM
YWJzLjAeFw01MTAxMDEwMDAwMDBaFw01MDEyMzEyMzU5NTlaMBgxFjAUBgNVBAMT
DUtvbXBsZXggTGFicy4wggggMA0GCSqGSIb3DQEBAQUAA4IIDQAwgggIAoIIAQCA
A+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+//////////////////////////////////////////////////////////////+
+//////////////////////////////////////////////////////////////+
+///++++HELLO+THERE++++////////////////////////////////////////+
+//////////////////////////////////////////////////////////////+
+///And/welcome/to/the/base64/coded/x509/pem/certificate/of////+
+//////////////////////////////////////////////////////////////+
+///KOMPLEX/MEDIA/LABS/////////////////////////////////////////+
+///www/dot/komplex/dot/org////////////////////////////////////+
+//////////////////////////////////////////////////////////////+
+///created/by/Markku+Juhani/Saarinen//////////////////////////+
+///22/June/2000///dw3z/at/komplex/dot/org/////////////////////+
+//////////////////////////////////////////////////////////////+
+///You/are/currently/reading/the/public/RSA/modulus///////////+
+///of/our/root/certification/authority/certificate////////////+
+//////////////////////////////////////////////////////////////+
+///Which/happens/to/be/16386/bits/long////////////////////////+
+//////////////////////////////////////////////////////////////+
+///And/fully/working/and/shit/////////////////////////////////+
+//////////////////////////////////////////////////////////////+
+///And/totally/insecure///////////////////////////////////////+
+//////////////////////////////////////////////////////////////+
+///You/can/save/this/text/to/a/file/called/foo/dot/crt////////+
+///Then/click/on/it/with/your/explorer/and/you/can/see////////+
+///that/your/system/doesn+t/quite/trust/the/komplex/root//////+
+///CA/yet+////////////////////////////////////////////////////+
+//////////////////////////////////////////////////////////////+
+///But/that+s/all/right///////////////////////////////////////+
+//////////////////////////////////////////////////////////////+
+///Just/install/it////////////////////////////////////////////+
+//////////////////////////////////////////////////////////////+
+///And/you+re/happily/part/of/our/16386/bit/public/key////////+
+///infrastructure/////////////////////////////////////////////+
+//////////////////////////////////////////////////////////////+
+///One/more/thing/////////////////////////////////////////////+
+//////////////////////////////////////////////////////////////+
+///Don+t/try/read/this/with/other/PKI/or/S/MIME/software//////+
+///Cause/this/cert/is/not/really/x509/compatible//////////////+
+//////////////////////////////////////////////////////////////+
+///+/mj///////////////////////////////////////////////////////+
+//////////////////////////////////////////////////////////////+
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
////////////////////////////////////////AAIBATANBgkqhkiG9w0BAQQF
AAOCCAEAAAH/////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////ADAgMAwGCCqGSIb3DQIFBQAEEKGhHCKQYa9YjOZdQEi/TSE=
-----END CERTIFICATE-----

---

From: Rich Salz <[email-masked]>
Date: Tue, 06 Nov 2001 18:37:08 -0500

> we should concentrate on developing some PKIX / RFC

Most of us in this field would rather not knowingly become charlatans
and frauds.  Building something that looks like a secure and
interoperable system when you know it's not, just to give users the
appearance of same... yuk.
	/r$

-- 
Zolera Systems, Securing web services (XML, SOAP, Signatures,
Encryption)
http://www.zolera.com