Subject: Signed e-mail

From: Henrik Bergman <[email-masked]>
Date: Mon, 12 Nov 2001 06:55:26 +0100

>Khaja, you are pointing to a very important thing.
>
>The need of signed messages for two categories:
>1. Humans
>2. Computers
>
>For humans, the need isn't very big if we are talking about
>authentic messages. I think many of us
>already know what contents a message could contain. If it doesn't
>contain things from that area, we
>will suspect that something is wrong. There for the value for signed
>e-mails  is limited. Especially
>is you consider how much work it usually is to maintain your
>certificates and program installations.
>
>If we continue to the next category, computers, the need is quite
>different. We still don't have any
>Java-objects for AI around telling the business application when we
>should suspect the transaction
>to be faulty. Therefor computer to computer in B2B is an ideal
>situation for PKI. But as you pointed
>out, the interoperability between different CA's is very low. And I
>remember a long lived discussion
>on this list about "Basic Cert-2-Directory mapping". The discussion
>showed (at least myself) that
>standards do not tell anything about what (minimum) a certificate
>should contain, only what it COULD
>contain. This opens a wide variety of certificates, all following
>the standard of cause, that
>confuses the market. This will lead us to a discussion about the
>need for permanent identifiers.
>
>Bob once said, the only this a CA could guarantee is a unique (with
>this CA) number. Everything else
>is just a snapshot (Bob didn't said that, I added it!) and will vary
>over the time.
>
>So what's the conclusion?
>
>For me it's that certificates and signed messages should be used in
>B2B between computers
>(especially for $1M transactions).
>Certificates should be simple (subject contents), as most vital and
>dynamic information is available
>from other sources ONLINE!
>
>Regards
>
>Henrik Bergman
>X-OBI AB

--
__________________________________________
Henrik Bergman, X-OBI, mob 070-866 87 72
e-mail: [email-masked]

---

From: "todd glassey" <[email-masked]>
Date: Mon, 12 Nov 2001 06:45:51 -0800

----- Original Message ----- 
From: "Henrik Bergman" <[email-masked]>
To: <[email-masked]>; <[email-masked]>
Sent: Sunday, November 11, 2001 9:55 PM
Subject: Signed e-mail

> >The need of signed messages for two categories:

You of course mean "Too their Digital Agents"

---

From: Henrik Bergman <[email-masked]>
Date: Mon, 12 Nov 2001 16:03:25 +0100

Todd, I mean

1. humans, e-mail read and processed by you and me.
2. computers, business transactions between business systems over Internet. Data transferred between
systems without any manual interception. Computers that are used in business or processing industry.

And ofcause "2. computers" are always some kind of digital agents in service for humans in the end.
But they are without human control in the daily life transactions. The human part comes later in the
process.

Can anyone else understand this??

/Henrik

---

From: "todd glassey" <[email-masked]>
Date: Mon, 12 Nov 2001 07:06:14 -0800

Partner - one of the biggest problems we as technologists face is how to
translate our vision into Human Process. That is also why use models are so
important so that we do not design technologies as   a group that are
impossible to field.

T,
----- Original Message -----
From: "Henrik Bergman" <[email-masked]>
To: "todd glassey" <[email-masked]>
Cc: <[email-masked]>; <[email-masked]>
Sent: Monday, November 12, 2001 7:03 AM
Subject: Re: Signed e-mail

> Can anyone else understand this??

Its their audit processes and the describing of their use models so that we
know what they are and are not supposed to do, that makes this all possible.

---

From: <[email-masked]>
Date: Mon, 12 Nov 2001 10:50:52 -0800

Ah, so we are back to one of the original questions of everyday
transactions - Who do I trust and just how much do I really trust them?

On an everyday basis, people everywhere apply some decision making process
(with or without full awareness of the process) to every transaction that
occurs between them. To take this a step further, business policy applied to
computing systems often tries to make this sort of decision process and
apply it to applications.  PKI is one way that this trust binding is
attempted and it often fails quite miserably. Humans seem to do this
relatively effortlessly based on thier experiences.

What's really wrong with PKI is that is it is difficult for most people to
implement and costly to use and it just doesn't happen as quickly as some
human judgment call on who they trust in any transaction.  Where is the
granularity of trust levels, the recognition that trust is temporal and
transitive presented in a fairly simple way for the everyday programmer use?

We can now plaster the world with X509 certificates in various forms that
work the way it was intended (and this has taken several years) but we as a
group have done little to make it easy and relatively idiot proof to use PKI
in applications (and there are many
perfect idiots in our wide world).

I have looked into and tested many a CA vendor's toolkit and let me say it
just isn't easy to use any of them. Where is the application enabling
middleware that is easy to use? (Yes, there are several other standards
groups addressing this is some piecemeal fashion and there are some vendors
who are beginning to address this space.)

 I look at a lot of the work being done with PKI and XML in wonderment of
really allowing the "average"  (read, less experienced) programmer who will
follow some standard and then really botch things up, expose keys, etc due
to lack of knowledge on how to do it securely.

Let's get real and do something about all this, that makes PKI an easy and
reliable method of enabling trust on an everyday basis with all the goodness
that PKI offers instead of making it so difficult that the average user
would rather get a root canal than use PKI.

Just my opinion,

	Jean Pawluk

PS As an architect and senior manager I am often astounded how many firms do
not know thier own business well enough to decide what needs to be secured.

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Henrik Bergman
Sent: Monday, November 12, 2001 7:03 AM
To: todd glassey
Cc: [email-masked]; [email-masked]
Subject: Re: Signed e-mail

Todd, I mean

1. humans, e-mail read and processed by you and me.
2. computers, business transactions between business systems over Internet.
Data transferred between
systems without any manual interception. Computers that are used in business
or processing industry.

And ofcause "2. computers" are always some kind of digital agents in service
for humans in the end.
But they are without human control in the daily life transactions. The human
part comes later in the
process.

/Henrik

---

From: Henrik Bergman <[email-masked]>
Date: Mon, 12 Nov 2001 22:28:33 +0100

> transactions - Who do I trust and just how much do I really trust them?

For me it's not just about trust. Some vise comment about signed e-mail stated that this will
prevent virus via e-mail. But if the virus take advantage of your e-mail client and sends faulty
infected signed e-mails, the signing doesn't add any security in that case.

PKI for personal use hasn't happen on a big scale yet. It may never happen, at least not in the
inteded way. We don't se pc's with smartcard readers as default equipment. We don't logon to windows
or linux or what ever, using smart cards and digital certificates. We still uses old userid and
passwords!!

Instead different addon security is used like SecurId from RSA or something like that. Scandinavian
bank is using a variety of solutions from calculator like security equipment, one time tickets, and
soft certificates. Smart cards were tested, but I think few are using them now. There was to much
support needed for the rollout.

> transitive presented in a fairly simple way for the everyday programmer use?

As I'm trying to rollout PKI middleware, very little is done in common applications today. Security
is no big issue, is a common sentence. But I think it will be a major issue if someone send
thousands of false orders into a big company. THAT will cost much to manually repair. And this
market must wake up and see the big thing about using PKI between organizations and companies. If we
analyze what needs that puts on X.509 certificates (hard or soft), it's not very much. I think we
only need a stabile identifier (other than commonname, organization etc) like duns-number or
something simular. With that identity it's possible for ordinary application programmers (who are
not PKI experts) to understand, trust and build bullet proof applications.

> Just my opinion,

Yepp, KISS

/Henrik