Subject: Re: AC Scenarios - PULL model

From: "Bob Jueneman" <[email-masked]>
Date: Tue, 14 Nov 2000 08:35:46 -0700

>Steve,
>
>> ac509prof (section 5) says that "The AC issuer MUST be directly trusted
>> as an AC issuer (by configuration or otherwise)." It also says (section
>> 1.1) "This specification deals with the simple cases where one authority
>> issues all of the ACs for a particular set of attributes."
>> 
>> Therefore, I expect that the AC verifier will only have a single trusted
>> AC issuer (or one for each set of attributes). Because of this, the AC
>> verifier (in the pull scenarios) should be able to pull all ACs from a
>> single repository or AC issuer (or one for each set of attributes).
>> There is no need for the PKC to include information about where to find
>> ACs. In the AC pull scenarios, the AC verifier will have this
>> information already configured. This model works in either an intranet
>> or an extranet case. The PKC may be issued by a third-party CA. But the
>> AC will always come from the single trusted AC issuer.
>
>That's my definition of a system that does not scale and have severe
>built-in security problems.  I.e. multi-party update/access to a single repository
>containing fairly dynamic individual-specific information.  A single issuer is
>*not* a requirement so far as I can see.  It that really is the case this scheme
>needs a *major* fix which I BTW see no chance of accomplishing.
>
>Question from a directory "Newbe": Can interlinked directories administered by
>the "business parties" themselves, form a virtual single repository (and therefore
>single verifier configuration), supporting multiple AC issuers? 
>
>Anders
>
Anders, we refer to such "interlinked" directories as "federated".  And we have made some considerable amount of effort to support such federation.  But speaking only personally, and not someone who is a bone fide directory savant, although I think the technical problems are solvable, I suspect that the management problems are not -- at least not very easily.

Just consider how much effort has gone into trying to define a common schema between two disparate directories, for example when two companies merge.  It is a major, major headache, and likely to cause all sorts of backwards compatibility problems with existing applications.  And that is sort of the best case, when there are only two players, and they are cooperative and mutually trusting.  (Having gone through some mergers, I'm biting my tongue a little bit on that one. :-)

Now consider the problem when multiple parties want to federate their directories.  Not only to the schemas have to be aligned, but all of the rights management and everything else. And then there is the transitive trust issue -- if A decides to trust B to access (read or write) A's data, and B decides to trust C, does that mean that A trusts C? Not necessarily, yet with the usual type of ACLs (discretionary access controls) it is very difficult to manage such rights.

For these political reasons, over and above the technical ones, I think you are exactly correct.  A single issuer is not likely to work, IMHO.

Bob

Robert R. Jueneman
Security Architect
Novell, Inc. -- the leading provider of Net services software