Subject: Re: [therightkey] Will the real RPF please stand up?

From: "Joe St Sauver" <[email-masked]>
Date: Thu, 9 Feb 2012 15:14:35 -0800 (PST)

Steve commented:

#I think we are in agreement. CAs that are not authoritative for asserted
#identities are as bad as federated trust entities with similar properties.

I tend to be a concrete thinker, so I hope you'll indulge me for a minute
in a concrete exercise related to your assertion.

-- Assume a hypothetical CA is operated by a national government, and it
   issues client certs to citizens of that nation. I belive that this would
   like be an example of a CA that is authoritative for the identities that
   it is asserting -- true? (We'll set aside issues of how governments
   bootrap a definitive identification document in the potential absence 
   of an existing definitive identification document)

-- Would a hypothetical CA operated by a corporation, issuing client certs
   to its employees, also be authoritative for its employees from your
   point of view? Does it matter if they assert a name or a company email
   address or ? (We'll set aside the possibility that credentials might
   be able to be issued by the corporation without the involvement of the
   employee nominally associated with that credential)

-- What's the solution for the person who lacks a authoritative source
   for a certificate? Would it be better if they simply couldn't get a 
   cert? Or is there some road that they might travel that might allow
   them to find (like Dorothy and the Wizard of Oz), someone who could 
   become authoritative for them? 

-- What if the authoritative source is unwilling to issue credentials to
   one of its subjects/employees/members? (e.g., think of some individuals
   who have been denied the right to travel in some countries in the past)
   Should there be the certificate equivalent of a Nansen passport for
   those who are effectively stateless? 

Or should we just be trusting a certification authority to do what it 
says it will do in its CPS, perhaps just confirming that an email address
asserted in a certificate request is indeed accessible by the party that's 
requesting a cert with that "identity"?

Thanks,

Joe

---

From: Stephen Kent <[email-masked]>
Date: Thu, 9 Feb 2012 19:22:41 -0500

>in a concrete exercise related to your assertion.

no problem.

>    of an existing definitive identification document)

yes, this is a good example, if the certs convey the identity of the 
individuals as citizens of that country.

>    employee nominally associated with that credential)

A CA operated by a company is the right CA to identity individuals as 
employees of that company. if the company operates it's domain and 
manages mailboxes for its employees in that domain, then it is he 
right CA to issue certs with
employee e-mail addresses.

>    become authoritative for them?

Note that the citizen and employee certs are not universally 
acceptable for all transactions. The citizen cert is analogous to a 
passport, and I can't use a passport in lieu of a driver's license or 
an Amex card. We need different certs to express different forms of 
identity. So, I think the right question is what classes of certs do 
people need, for which classes of transactions. If I can get a 
driver's license or state-issued ID card, then I ought be be able to 
get the same credential in cert format.

So, If a person has no e-mail address, he ought not get a cert with 
an email address in it. If you have a Gmail address, then Google is 
the right entity to issue a cert with ONLY an e-mail address in it.

Given this explanation, I don't understand you question. it sounds 
like you are thinking of a one cert per person model, which is the 
antithesis of what I suggested.

>    those who are effectively stateless?

Depends. If a company will not issue certs to its employees, then they can't
be reliably certified as employees of the company in question. 
Nansen passports are not issued anymore, but the moral equivalent is 
issued by the UN today. Such a cert would not identity the holder as 
a citizen of a specific country, which is the feature of a passport.

>requesting a cert with that "identity"?

Trusting a CA based on its CPS, without an ability to constrain the 
scope of identities that the CA can certify is dangerous. This is why 
we have the current mess of

Steve

---

From: DIEGO LOPEZ GARCIA <[email-masked]>
Date: Fri, 10 Feb 2012 08:48:23 +0100

> we have the current mess of

Just wanted to say that though we started in some disagreement about ID federations, I'd sign that statement and apply it to identity assertions in federations as well.

Be goode,

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
http://people.tid.es/diego.lopez/

e-mail: [email-masked]
Tel:    +34 913 129 041
Mobile: +34 682 051 091
-----------------------------------------

Este mensaje se dirige exclusivamente a su destinatario. Puede consultar nuestra política de envío y recepción de correo electrónico en el enlace situado más abajo.
This message is intended exclusively for its addressee. We only send and receive email on the basis of the terms set out at
http://www.tid.es/ES/PAGINAS/disclaimer.aspx