Subject: RE: Software for PKI

From: [email-masked] (Peter Gutmann)
Date: Thu, 8 Nov 2001 10:00:06 +1300 (NZDT)

"Harrington, Chris" <[email-masked]> writes:

>>indicates that the majority of technical computer users (let alone Joe
>>Sixpack) don't understand PKI and can't do much with it if you hand it to
>>them
>I am in agreement with that. However, I don't feel that users should HAVE to
>understand PKI in order to use it. 

Read the paper I referred to ("Why Johnny can't encrypt", Usenix Security'99,
it's scary reading).  Users weren't asked to understand PKI, they were asked to
exchange encrypted mail with someone else.  One person out of 12 managed it.
The others (with access to manuals, online help, etc etc) didn't.  Not a good
sign, particularly since PGP's laissez-faire key management (and accompanying
simple UI) is far less complex than any X.509-type system.

The problems weren't just a single failure, in most cases each user ran into a
whole series of stumbling blocks starting with an inability to understand the
concept of public-key encryption (as the author of a free crypto library I
don't know how many times people have asked me to explain this), sending out
plaintext thinking they'd encrypted it, not knowing which key to encrypt with,
misunderstanding of signing vs encryption keys, private vs public keys, not
knowing about trusting or not trusting keys, etc etc, every failure type you
can think of and then some (I have a paper in preparation which looks at some
of these issues, hopefully it'll be published next year).

>Jennifer brings up a good point about SSL being widely used because it is
>transparent to Joe Sixpack.

There is a difference between transparent and oblivious.  SSL is most
definitely the latter, all you need to do is make sure you buy your cert from a
CA which won't produce a warning dialog when the browser connects and you're
set.  Because of this, SSL certs offer about the same security as
unauthenticted DH (without the PFS benefits).  It is very transparent though.

Peter.

---

From: Eric Rescorla <[email-masked]>
Date: 07 Nov 2001 15:10:01 -0800

> unauthenticted DH (without the PFS benefits).  It is very transparent though.
This isn't QUITE true. Most clients check the URL against the hostname in
the certificate. Ostensibly the CAs check that you're entitled to a
certificate with said hostname before issuing.

-Ekr

-- 
[Eric Rescorla                                   [email-masked]]
                http://www.rtfm.com/

---

From: Michael Ströder <[email-masked]>
Date: Thu, 08 Nov 2001 11:08:22 +0100

> certificate with said hostname before issuing.

But nobody really checks the CA certificates shipped with the
browsers.

Ciao, Michael.

---

From: Aram Perez <[email-masked]>
Date: Thu, 08 Nov 2001 20:30:10 -0800

> But nobody really checks the CA certificates shipped with the
You are absolutely right! I've stated here before that most folks 
implementing PKIX forget that the root certificates (or anchor 
certificates) require an out-of-band verification mechanism.

My dos centavos,
Aram Perez