Subject: WG Last Call on draft-ietf-pkix-tac-03

From: Stefan Santesson <[email-masked]>
Date: Thu, 02 Apr 2009 12:52:03 +0200

The authors of Traceable Anonymous Certificate draft-ietf-pkix-tac-03.txt
has requested WGLC.

http://tools.ietf.org/html/draft-ietf-pkix-tac-03

WG Last call on this document starts today and ends April 17 to give room
for Easter holidays.

/Stefan

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 2 Apr 2009 14:56:29 +0100

Stefan Santesson wrote:
> The authors of Traceable Anonymous Certificate
> draft-ietf-pkix-tac-03.txt has requested WGLC.
> 

A couple of comments:

#1: Top of p7:
  "To effect issuance of the TAC, the AI interacts with
   the BI, over a secure channel, to jointly create the signature on
   the TAC, and sends the signed TAC to the user.

   The AI does this without learning the user's real identity
   (either from the user or from the BI)."

If the AI sends the TAC to the user, then it will know some
form of identity for that user, even if that's only an IP
address. (And with the likes of SAVI, that could well be
enough to establish a real identity.)

I'd have thought it'd be much better to return the TAC
via the BI and not require any user<->AI direct connections?

#2: Section 5.2 claims that the AI can't unilaterally fool
the BI into revealing the real identity. But the only thing
that stops that seems to be the RP client identity verified
by the BI when the RP establishes a mutual-auth TLS connection
to the BI.

So how can the BI really know that its not the AI making that
connection?

Stephen.

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 2 Apr 2009 14:56:29 +0100

A couple of comments:

#1: Top of p7:

Stephen.