Subject: RE: Software for PKI

From: "Bob Jueneman" <[email-masked]>
Date: Wed, 07 Nov 2001 14:47:04 -0700

It's rather ironic that as we are finally nearing the end of the PKIX development effort we are beginning to talk about why it isn't being used.

Let me offer my two cents worth:

I believe that we have passed over the peak of technology hype, and are now wallowing in the trough of disillusionment that always follows that kind of crest.  Unfortunately, the collapse of the dot-coms and the rest of the economy happened to coincide with the this disillusionment, and 9/11 has made matters even worse.  But although it may be difficult to see the bright side right now, I believe we will eventually climb out of this, and public key technology will be used -- either with or without PKI as we presently know it.

1.  The alleged communications security threat that PKI was envisioned as solving simply not perceived to be real.  Most companies just don't have any hard evidence that their e-mail is being compromised  -- at least not enough to justify implementing end-to-end S/MIME for the average user.  The Internet is envisioned by Joe Sixpack as being a dangerous place, but that is because of computer viruses and compromised web sites, NOT because of eavesdropping.

2.  Despite the hype and hopes for using PKI for e-commerce, nonrepudiation, etc., that hasn't materialized either.  By the time you get through reading all of the fine print behind the CA's policies, plus all of the legal  ifs, ands and buts required to effectively implement non-repudiation, you realize that there is no way that a TTP CA could really do a bang-up job of due diligence for any reasonable priced certificate.  So you might as well negotiate a set of business practices with your trading partners directly, and in which case you don't need a TTP CA at all -- you just need his certificates or certificate chain, without regard to any particular trusted root. So PKI doesn't scale nearly as well as we had hoped it would, primarily because of legal and business reasons, as opposed to technical ones.

3.  Perhaps the biggest single blunder that the PKI advocates committed (and I would include myself in that, unfortunately), was to focus excessively on the issue of identity.  In business no one really cares much about identity -- on the Internet no one knows you're a dog -- they just want to know what you are authorized to DO, and whether you will pay your bills.  Identity information provides an easy way to look up that information, but is otherwise relatively useless (except perhaps for audit, which no one does anyway).  And identity also collides with privacy, and may be perceived as making matters worse, rather than better.  Unfortunately, X.509 and PKIX got around to grappling with the issues of authorization and rights far too late in the game, with mechanisms that were poorly thought out (and remain so to this day) and never widely implemented.

In summary, PKI has not failed so much as TTP CAs have failed (at least for end users), and S/MIME has failed  both for lack of a demonstrable threat (unless you are a terrorist, in which case you would probably want to use steganography rather than cryptography, to avoid disclosing that you are doing something that might be suspicious) and because deployment is too hard.

On the other hand, PKI has succeeded brilliantly in solving the identity problem for SSL, where it is now ubiquitous.  And it has been at least marginally successful in dealing with the security issues involved in executing downloaded applets, despite the debacle of the bogus Microsoft certificate.  And those areas are precisely where the focus on identity (and implied rights) is exactly on target.

In addition, PKI has failed because provisioning is too hard, i.e.,  too hard to manage.  Going to VeriSign for one certificate at a time is too much work and costs too much, but installing something like VeriSign's On-Site or the various toolkits available from Entrust or Baltimore Technologies takes too much of a leap of faith -- the cost of entry for a company is too high.

Finally, another blunder within the PKIX community was in avoiding making a firm commitment to use directory technology to distribute certificates, while at the same time not espousing any other workable solution either, such as some kind of an http mechanism.  As a result, S/MIME is too hard to use because it is too hard to get your hands on the recipient's certificates unless you go through a cumbersome exchange of signed e-mails and manually enter them into to your list of recipient's certificates. Yuck.  And I won't even mention the problem of managing trusted roots.

Sigh.  "Ve get so soon alt, und so late schmart."

Bob

>>> "Harrington, Chris" <[email-masked]> 11/07/01 12:20PM >>>

>indicates that the majority of technical computer users (let alone Joe
Sixpack) don't understand PKI and can't do much with >it if you hand it to
them 

I am in agreement with that. However, I don't feel that users should HAVE to
understand PKI in order to use it. Can you imagine how much web surfing
would be going on if Joe Sixpack had to understand TCP/IP and HTML. Jennifer
brings up a good point about SSL being widely used because it is transparent
to Joe Sixpack. 

Chris

-----Original Message-----
From: Peter Gutmann [mailto:[email-masked]] 
Sent: Wednesday, November 07, 2001 12:18 PM
To: [email-masked] 
Subject: RE: Software for PKI

"Harrington, Chris" <[email-masked]> writes:
>>>Finally, we seem to be making progress in getting signatures and
certificates
>>>sufficiently accesible for the average citizen to start actually using!
>>Is this of any value if they're mostly worthless?
>Instead of shouting at the rain about how insecure MS CAPI may or may not
be,

It wasn't so much a comment on security (or lack thereof), it was a reply to
the original poster's question about needing something to test PKIX
standards
with.  My response to Peter Williams' comment was that for testing PKIX
standards compliance, the PKI stuff which comes with Windows isn't terribly
useful.

>we should concentrate on developing some PKIX / RFC compliant apps that
give
>the users that "warm and fuzzy" feeling.
>
>Thoughts??

Now that's something I'd really like to see.  So far the *sole* PKI
usability
study which has been done ("Why Johnny can't encrypt") indicates that the
majority of technical computer users (let alone Joe Sixpack) don't
understand
PKI, and can't do much with it if you hand it to them (and PGP is probably
about as usable as the Windows PKI stuff, at least from what I've seen of
either).  How can we make it usable?  More importantly, *can* we make it
usable?  Will Joe Sixpack ever be able to sit down and do something
meaningful
with certificates?  Or will Passport (warm fuzzies technology if ever I saw
it)
conquer the world while we're still trying to figure out how to get an LDAP
schema everyone can agree on?

(At the moment I'm kinda putting my money on the last option, sigh.  If
there's
 any HCI people out there who'd like to work on a paper on making PKI usable
 for end users, please get in touch).

Peter.

---

From: [email-masked] (Regunathan Rajaiah)
Date: Wed, 07 Nov 2001 17:24:52 -0500

Hi Bob
    Thanks for the great "state of the PKI"  mail . I fully agree with you about PKI now. It is a much expensive proposition with not so quantifiable returns [for lack of right word]. My colleague used to say "This year going to be the year for PKI" every year

---

From: "Douglas E. Engert" <[email-masked]>
Date: Wed, 07 Nov 2001 17:03:52 -0600

Bob Jueneman wrote:
> 
> It's rather ironic that as we are finally nearing the end of the PKIX development 
> effort we are beginning to talk about why it isn't being used.
> 

Don't count it out yet! There is another area where PKI it is starting to be used, and 
that is Grid Computing. Here PKI is used with SSL for authentication and authorization
from smart cards on workstations to super computers.   

See:
 Globus Project(tm)    http://www.globus.org
and
 Global Grid Fouum     http://www.gridforum.org  
and
Super Computing 2001   http://www.sc2001.org   (NEXT WEEK) 

One of the missing pieces with SSL and PKI was delegation. We have added that and have
submitted an updated version to the WG:

  Internet X.509 Public Key Infrastructure Proxy Certificate Profile      
http://www.ietf.org/internet-drafts/draft-ietf-pkix-proxy-01.txt

--

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444