Subject: RE: Common misconceptions, was Re: KISS for PKIX. (Was: RE: ASN.1 vs XML (used to be RE: I-D ACTION :draft-ietf-pkix-scvp- 00.txt))

From: Anders Rundgren <[email-masked]>
Date: Fri, 16 Jul 1999 13:36:31 +0200

Ed,
<big snip>
>> I disagree with your statement that a certificate in software binds a
>> system, vs. a user.

>I fail to see how you can possibly disagree with Eric's statement.  Trust is not
>distributive in the social sense (ie, not associative in the mathematical sense),
>which alone opens the problem that (here, * is the trust operator):

 >(A*B)*K <> A*(B*K)

>and thus, for example, Alice may trust that Bob's certificate binds to Bob (ie, A*B)
>before Alice knows that Bob trusts Khadaffi (ie, B*K), but not afterwards (ie, A*(B*K)).
>Or, as another example, I may trust my lawyer before I know  that he trusts my competitor
>but not afterwards. Or, Bill may trust Monica before Bill knows that Monica trusts
>Linda, but not afterwards. In summary, this is the "unfaithful proxy " problem as I call it
>-- you can never tell is there is an unfaithful proxy. However, to think otherwise and to
>believe that (A*B)*K = A*(B*K) is a common misconception that leads one to believe
>that Bob's certificate binds to Bob irrespective of Bob's trust on Khadaffi -- in fact, Bob
>may not even exist.

Strange misconception between trust in certificates and bindings versus trust between people.
The latter is not suitable for IETF to handle!  It is basically a manual, indescribable, out-of-band process :-)

That is why you in an large PKI-scenario (inside an organization legal issues and non-repudian is
not that terribly interesting really), DESPERATELY NEED TTPs for issuing identity-certificates.  Even
crooks (Khadaffi?) can get one!  It is not particularly hard for a CA to verify that a person exists
(just by watching him/her) although an individual's "absolute identity" (whatever that mean) may
not always be correct.  The latter is IMO not a stumbling factor for PKI (particularly if biometrics
can be recorded and later verified) as you are unlikely to enter any serious relationship (Employment, 
Bank-account owner) without showing-up physically at least once.

The important thing that a TTP/CA must guarantee is that you must not be able to "borrow" another
individual's identity.  A set of credentials and biometrics does the trick. To certificate-wise get a NEW
identity is another thing which does not eliminate the value of PKI/TTPs/CAs as the subject is back
to square one for all his/her certificate-based relationships.  I.e. they are all gone.  

No signs of rocket-science IMHO.  KISS?  Naah, maybe not.

Note: I deliberately excluded national ID-CAs who HAVE to verify absolute identity (which is
harder and hander to do with all paper-less refugees in Europe).

Anders

---

From: Ed Gerck <[email-masked]>
Date: Fri, 16 Jul 1999 09:32:52 -0700

Anders Rundgren wrote:

> >Stephen Kent wrote:

> Ed Gerck wrote:
> >distributive in the social sense ....
>
> > ... a common misconception that leads one to believe

If I understand what you are saying, you are saying that a certificate binds to a user
because it says so. This is not correct.

> harder and hander to do with all paper-less refugees in Europe).

The "harder and harder to do" is what makes a certificate not bind to a user -- and even
if you have all proper papers in notarized copies you still do not know.  And, BTW, just
read any CA warranty and you will see they also do not know and they say so -- "NO
WARRANTY, NO SUITABILITY OF PURPOSE".

Surely, you can rely on a certificate but only to the extent that it is warranted by the issuer.
But, you will not find a CA that does that without caveats that any fraudster case will fall
into and thus invalidate the assurances.  And, the CAs are right -- it cannot be warranted
that  a certificate binds to a user. This alone already shows in the practice what I tried to
explain.

Cheers,

Ed Gerck