Subject: Re: [pkix] Revocation and TLS/SSL Replacements/Enhancements

From: =JeffH <[email-masked]>
Date: Wed, 28 Mar 2012 05:02:59 -0700

[ trimming cc: to just pkix@ ]
[ topic trimmed to Revocation and TLS/SSL Replacements/Enhancements ]

 > a) Doesn't mention Certificate Transparency.

indeed. neither did it mention CRLSets.

 > b) Thinks Sovereign Keys (and presumably, had they mentioned it, CT) is
 > a TTP, which is incorrect.

I tend to agree, tho it depends on how one defines a trust 3d party (TTP). 
Their definition is different than yours it would seem.

=JeffH

---

From: Tom Ritter <[email-masked]>
Date: Wed, 28 Mar 2012 08:13:29 -0400

On the same topic, I recently published a whitepaper as part of Black
Hat, a subset of which also covers "Revocation and PKI Improvements".
(The whole paper also goes into TLS improvements of the past couple
years, things in draft status, STS, Caja, CSP, etc, etc.)  At the end,
(in the very last section), I tried to find a set of concepts that
would be good to keep in mind when evaluating any PKI or Revocation
proposal. The paper is at http://ritter.vg/p/2012-TLS-Survey.pdf and
there's a video here, although it doesn't go into as much detail about
the PKI stuff: https://media.blackhat.com/bh-eu-12/videos/bh-eu-12-Ritter-Future-of-Security-Protocols.mp4

I'm working on a followup which inverts the discussion, talking about
the properties we like (such "No Extra Network Trips") and thinking
about the fundamental ways (and constraints) to achieve that.

-tom

On 28 March 2012 08:02, =JeffH <[email-masked]> wrote:
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 29 Mar 2012 14:42:20 -0400

Umm, it is trusted to provide a service but constrained in the service
it provides.

If there was only one DNS registrar, that company could keep you off
the Internet by refusing to provide you with any domain. If there are
multiple registrars then this becomes a less practical attack but so
does the SK protocol.

Given the lack of details that the authors of these proposals have
provided, I am really not sure what is part of their proposal and what
is being read into them by reviewers. Like certain politicians policy
proposals they can satisfy everyone right up until they are required
to specify them in sufficient detail that people can see what it does
not cover.

Very often a protocol design will be able to support A or B but not
both. You can eliminate false positives in spam filtering very easily,
as you can with false negatives: just accept everything or nothing.
Yet during the DKIM discussions we had people whose approach to policy
was that the client would use algorithm A to interpret it in one case
and algorithm B to interpret it in another. And they just would not
accept the fact that this was not a solution to the problem

-- 
Website: http://hallambaker.com/

---

From: Ben Laurie <[email-masked]>
Date: Fri, 30 Mar 2012 09:27:08 +0000

On Thu, Mar 29, 2012 at 6:42 PM, Phillip Hallam-Baker <[email-masked]>wrote:

> provided,

Which proposals are "these proposals"?

> I am really not sure what is part of their proposal and what

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 30 Mar 2012 07:11:08 -0400

SK no specification
Convergence no specification, just some markting pages and a talk
ranting against CAs.

I am not going to reverse engineer people's ideas from code unless I
am being paid my expert witness/consultant rate and there is a
particular reason (e.g. patent dispute) that the code in question is
worth reading.