Subject: RE: Software for PKI

From: Jim Peterson <[email-masked]>
Date: Tue, 6 Nov 2001 15:31:20 -0600

Good point.  Mass market acceptance is critical to move PKI out of the
technical discussion groups and into the mainstream.  Mass market today
equates to MS-Windows.  PKI is too difficult for most desktop users to deal
with at this time and is still giving many experienced IT staff a challenge
implementing it for corporate IT.  Regardless of any concerns about MS CAPI,
it's what most of those desktops are running and the more simple trusted
applications there are that make using PKI seemless for the masses, makes it
that much easier to build on a solid base of "warm/fuzzy" users.

Jim Peterson 

-----Original Message-----
From: Harrington, Chris [mailto:[email-masked]] 
Sent: Tuesday, November 06, 2001 1:26 PM
To: [email-masked]'; [email-masked]; [email-masked]
Subject: RE: Software for PKI

>>Finally, we seem to be making progress in getting signatures and
certificates
>>sufficiently accesible for the average citizen to start actually 
>>using!

>Is this of any value if they're mostly worthless?

It is absolutely of value if you want mass market acceptance of PKI. By your
own statement the user will pick the "pretty" application over the
functional one. Instead of shouting at the rain about how insecure MS CAPI
may or may not be, we should concentrate on developing some PKIX / RFC
compliant apps that give the users that "warm and fuzzy" feeling. 

Thoughts??

Chris

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Saturday, November 03, 2001 1:26 AM
To: [email-masked]; [email-masked]; [email-masked]
Subject: RE: Software for PKI

Peter Williams <[email-masked]> writes:

>"Probably the finest" set of simple-to-use PKI (PKIX-I -complying
cert-based)
>programs for making/verifying digital signatures probably comes from 
>two of the most used and "usable" consumer programs in the world, 
>fortunately: Microsoft Office 2000, and PKZip - from a maker of the 
>infamous zip format
for
>compressing sets of files into an archive file.

The problem is that what you're getting with Windows isn't PKIX, it's MSIX.
The list of bugs in MS's certificate handling alone (in the X.509 style
guide)
is about the same size as that for all other vendors combined, and that
doesn't go into all the bugs and quirks of CAPI which affect public and
private key use, signing, and other things (but which don't really have much
place in the style guide so they're not listed there).

It may be easy to use, and you may get wonderful warm fuzzies from it, but I
wouldn't put any trust in the result.  It's the usual choice for users, do
you want something you can place some trust in, or do you want something
which looks pretty?  (Unfortunately in most cases it's the latter, but I
can't do much about that except try and educate the masses).

>It all makes testing PKI(X) really easy.

But what you're testing isn't anything like PKIX, it's MSIX.  If you want to
test interoperability with other instances of the Windows PKI then it's
fine, but to test PKIX capabilities you'll need to use something which
actually follows the PKIX RFCs and drafts.

>Finally, we seem to be making progress in getting signatures and
certificates
>sufficiently accesible for the average citizen to start actually using!

Is this of any value if they're mostly worthless?

Peter.

-----BEGIN CERTIFICATE-----
MIIQojCCCIoCAQAwDQYJKoZIhvcNAQEEBQAwGDEWMBQGA1UEAxMNS29tcGxleCBM
YWJzLjAeFw01MTAxMDEwMDAwMDBaFw01MDEyMzEyMzU5NTlaMBgxFjAUBgNVBAMT
DUtvbXBsZXggTGFicy4wggggMA0GCSqGSIb3DQEBAQUAA4IIDQAwgggIAoIIAQCA
A+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+//////////////////////////////////////////////////////////////+
+//////////////////////////////////////////////////////////////+
+///++++HELLO+THERE++++////////////////////////////////////////+
+//////////////////////////////////////////////////////////////+
+///And/welcome/to/the/base64/coded/x509/pem/certificate/of////+
+//////////////////////////////////////////////////////////////+
+///KOMPLEX/MEDIA/LABS/////////////////////////////////////////+
+///www/dot/komplex/dot/org////////////////////////////////////+
+//////////////////////////////////////////////////////////////+
+///created/by/Markku+Juhani/Saarinen//////////////////////////+
+///22/June/2000///dw3z/at/komplex/dot/org/////////////////////+
+//////////////////////////////////////////////////////////////+
+///You/are/currently/reading/the/public/RSA/modulus///////////+
+///of/our/root/certification/authority/certificate////////////+
+//////////////////////////////////////////////////////////////+
+///Which/happens/to/be/16386/bits/long////////////////////////+
+//////////////////////////////////////////////////////////////+
+///And/fully/working/and/shit/////////////////////////////////+
+//////////////////////////////////////////////////////////////+
+///And/totally/insecure///////////////////////////////////////+
+//////////////////////////////////////////////////////////////+
+///You/can/save/this/text/to/a/file/called/foo/dot/crt////////+
+///Then/click/on/it/with/your/explorer/and/you/can/see////////+
+///that/your/system/doesn+t/quite/trust/the/komplex/root//////+
+///CA/yet+////////////////////////////////////////////////////+
+//////////////////////////////////////////////////////////////+
+///But/that+s/all/right///////////////////////////////////////+
+//////////////////////////////////////////////////////////////+
+///Just/install/it////////////////////////////////////////////+
+//////////////////////////////////////////////////////////////+
+///And/you+re/happily/part/of/our/16386/bit/public/key////////+
+///infrastructure/////////////////////////////////////////////+
+//////////////////////////////////////////////////////////////+
+///One/more/thing/////////////////////////////////////////////+
+//////////////////////////////////////////////////////////////+
+///Don+t/try/read/this/with/other/PKI/or/S/MIME/software//////+
+///Cause/this/cert/is/not/really/x509/compatible//////////////+
+//////////////////////////////////////////////////////////////+
+///+/mj///////////////////////////////////////////////////////+
+//////////////////////////////////////////////////////////////+
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
////////////////////////////////////////AAIBATANBgkqhkiG9w0BAQQF
AAOCCAEAAAH/////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////ADAgMAwGCCqGSIb3DQIFBQAEEKGhHCKQYa9YjOZdQEi/TSE=
-----END CERTIFICATE-----

---

From: Michael Ströder <[email-masked]>
Date: Wed, 07 Nov 2001 18:50:34 +0100

Jim Peterson wrote:
> equates to MS-Windows.

I saw much Windows software with bad usability. In the PKI field
almost all client software I saw up to now simply sucks. No matter
if Windows, MS CAPI or whatever OS is used.

The problem is that most vendors of PKI-enabled software have the
attitude not to deal with end users at all. Also there is currently
no mass market for PKI since PKI missionaries failed to provide an
added value for real life (please don't tell me about PKI being
crucial for e-commerce). Therefore nobody puts money into developing
good client software at the moment. It's a side job.

Ciao, Michael.

---

From: Michael Ströder <[email-masked]>
Date: Wed, 7 Nov 2001 13:50:01 -0800

Ciao, Michael.

---

From: Massimiliano Pala <[email-masked]>
Date: Thu, 08 Nov 2001 01:20:41 +0100

> The problem is that most vendors of PKI-enabled software have the
[...]
> good client software at the moment. It's a side job.

Hi, I've read your discussion and I think problems about PKIs are
mainly two:

   1. Complexity -> Many of the points pointed out in rfcs are
      far from reality, right now. Who really wants to give a good
      service to customers simply can not keep up-to-date with
      changes. And if you have not support for the latest rfc...

   2. Business Model -> Many vendors think the business is selling certs
      while it is not (to me). The real business is related to services
      (strong auth, digital signatures, etc... not only Internet-related(!)).
      Right now few are working on "Real-Life" apps -> users don't see "good
      reasons" to use certificates -> no requests for services
      -> no business...

Our project  is trying to  give the basic  software for  PKI  management
so as to give the opportunity to everyone to deal with PKIs and  related
objects. Unfortunately it is not an easy task if you don't have resources(!).

I guess the problem is not if M$ is doing the right stuff or not, but it seems
simply no one cares about real life. We used signed-forms since 1997 (or 1998
I can't remember) and are a great support for network related apps but AFAIK
we happen to be quite alone in this. Why ?

I sincerely hope this will change in the near future and we'll see apps
supporting this technology before it will be outdated (who knows if some
quantum-computers capable of breaking current algrithms exists....).

-- 

C'you,

	Massimiliano Pala

--o-------------------------------------------------------------------------
Massimiliano Pala [OpenCA Project Manager]                  [email-masked]
                                                          [email-masked]
                                                     [email-masked]
http://www.openca.org                            Tel.:   +39 (0)59  270  094
http://openca.sourceforge.net                    Mobile: +39 (0)347 7222 365

---

From: Michael Ströder <[email-masked]>
Date: Thu, 08 Nov 2001 11:07:08 +0100

>       changes. And if you have not support for the latest rfc...

Yes.

>       reasons" to use certificates -> no requests for services

Business models really failed. In 1998 I could convince my former
employer to run a X.509-based PKI for e-mails and strong
authentication. The users did not like having to use certificates
but they liked to be able to access their mailbox from around the
world. And I was happy with protecting network access with SSL and
client certs.

Later all PKI projects failed because nobody thought about the added
value a user(!) would have. E.g. banks tried to minimize their risk
by deploying digital signatures but wanted to charge the customer
for that. That's nonsens!

> I guess the problem is not if M$ is doing the right stuff or not,

Yes.

> We used signed-forms since 1997 (or 1998

I played with "signed forms" defined by Netscape in 1998. The main
problem is that it's only supported by Netscape Navigator 4.x. AFAIK
even recent Mozilla does not implement it anymore.

There are a couple of efforts implementing other standards for form
signing. But it's somewhat proprietary and again the business model
fails since the computer's owner has to pay for the plug-in.

> supporting this technology before it will be outdated 

I repeat a sentence I said a couple of months ago in a discussion
about storing certs in LDAP: The PKIX WG was far too much inspired
by the omni-potent X.500 directory world.

Ciao, Michael.