Subject: [pkix] NSTIC - National Strategy for Trusted Identities in Cyberspace

From: Anders Rundgren <[email-masked]>
Date: Thu, 26 Aug 2010 22:16:28 +0200

http://www.whitehouse.gov/blog/2010/06/25/national-strategy-trusted-identities-cyberspace

/    "For example, no longer should individuals have to remember an ever-expanding
     and potentially insecure list of usernames and passwords to login into various
     online services"

    "...a digital certificate on their cell phone..."
/
Quite interesting and visionary IMHO.

However, apart from finding out who is going to pay for all this, the USG people (consultants I presume...), who architected this grand strategy where probably not aware of the fact that there is
virtually no technology available addressing two-factor authentication on the Internet in a way that /consumers /can use (and appreciate):

- Computers are not [*] equipped with card readers
- Phones cannot [*] be provisioned with certificates
- Smart cards can only be provisioned off-line [*] but the world is hooked on on-line

The USG's counterparts in the EU and Asia who have already toiled with this for a decade have with few exceptions developed their own (highly proprietary) client software because the (US) platform
vendors' simply doesn't work.

A peek in the OpenSC mailing list gives you an idea of what characterizes a "smart card expert".   It is person who knows which card that works, with a specific card OS version, with a certain reader,
and using a particular version of middleware, and of course using a defined version of the host operating system!

*Way Ahead?
*
In addition to shelving the plan or creating something completely static like "Real ID", the best way forward could be funding the development of consumer-oriented two-factor authentication
technology.  Since the US is (most of the time) followed by other countries, /a successful project would likely in the end be running just about everywhere/.

An obvious project would be /enhancing /the already quite popular USB memory sticks so that they could also function as credential containers.   Imaging buying an USB memory/token at Wal-Mart and
getting credentials on-board when signing up to a service, using a standard browser on any PC or Mac!

thanx
Anders Rundgren

*] General case.

---

From: Anders Rundgren <[email-masked]>
Date: Fri, 27 Aug 2010 13:09:21 +0200

On 2010-08-27 00:01, Stephen Wilson wrote:

> But they can, via WPKI SIMs.

Yes, if:
- the customer has a contract with the phone operator
- the SIM-card supports PKI
- you buy the services needed to be able to provisioning SIMs
- the phone has integrated WPKI support

Using my definition of can and a decade-long perspective of no-avail
I regard this as "theory".  Some of the handset vendors have therefore
on the USG's "command" added $200+ Bluetooth card readers but I would be
very surprised if the general market buys into that:

http://na.blackberry.com/eng/ataglance/security/products/smartcardreader/

/Anders

> 
> On 27/08/2010 6:16 AM, Anders Rundgren wrote:
> 
>  > 
>  > "For example, no longer should individuals have to remember an 
> ever-expanding
>  > and potentially insecure list of usernames and passwords to login
>  > into various online services" "...a digital certificate on their cell
>  > phone..."
>  >
>  > However ...
> That's what they said about CD-ROM drives c. 1990.
> 
> But they can, via WPKI SIMs.
> 
> But provisioning offline -- aka out-of-band -- is a good thing for 
> security is it not?
> 
> I agree with you Anders that the USB key is a terrific form factor.  If 
> we added a crypto processor to the ubiquitous thumb drive then we could 
> put a powerful virtual ID wallet into a lot of consumers' hands.
> 
> USB keys are technically elegant but I have my doubts that a viable 
> supply chain can be built for general purpose ID containers.  When a 
> third party provisions a brand-less wallet, the user has to go from 
> place to place -- either on line or out of band -- and have it topped up 
> with different credentials.  Even in technologically sophisticated 
> societies like Malaysia and Hong Kong, maintaining a wallet of digital 
> IDs in their smartcards has proven difficult.
> 
> A more conservative approach -- in the sense that it preserves existing 
> supply chains and legal arrangements -- is for existing "identity 
> providers" (banks, governments, telcos etc.) to provision their 
> credentials onto superior PKI-enabled media, like smartcards and smart 
> phones.  The smartcard is so natural to use, and has such momentum in 
> healthcare, government and payments, that I have high confidence the 
> industry will overcome the practical obstacles: readers and drivers.  
> Built-in smartcard readers are fast emerging already, and the driver 
> problem has been solved before for other peripheral devices.
> 
> Cheers,
> 
> Stephen Wilson
> Managing Director
> Lockstep Group
> 
> Phone +61 (0)414 488 851
> www.lockstep.com.au
> Lockstep Consulting provides independent specialist advice and analysis
> on digital identity and privacy.  Lockstep Technologies develops unique
> new smart ID solutions that enhance privacy and prevent identity theft.
> 
> 
> 
> 
>

---

From: "Moudrick M. Dadashov" <[email-masked]>
Date: Fri, 27 Aug 2010 14:47:14 +0300

>> But they can, via WPKI SIMs.
The minimal requirement is a (W)PKI SIM where the client software can be 
provisioned by OTA upon clients desire.
Some operators upgrade to (W)PKI SIM cards for free. :)

Thanks,
M.D.
cell: +370-699-26662

> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix

---

From: Anders Rundgren <[email-masked]>
Date: Fri, 27 Aug 2010 14:15:31 +0200

> Some operators upgrade to (W)PKI SIM cards for free. :)

I was not referring to a local case where this may be possible but to the
general case where it does not work.  In Sweden the banks have given up on the
handset makers and use SIM TK but SIM TK has zero integration in mobile apps
like browser and VPN so IMO mobile PKI has essentially not progressed from
the point where it was a decade ago.

In the US I'm sure that the operators are entirely uninterested in PKI-enabled
SIM since the USG has selected another (equally awkward) solution.

If fact, in the longer run I expect the SIM to become an "endangered specie"
since it is not even holding our "telephone books" anymore (in general).

Anders

---

From: "Miller, Timothy J." <[email-masked]>
Date: Fri, 27 Aug 2010 09:14:14 -0400

DoD only supplied requirements; the vendors came up with solutions.  The only 'command' involved was some of the modifications to some of the systems, primarily because Bluetooth security is a joke.  

There are other smartcard readers for smartphones on the market, but most have a user experience that stinks on ice (think about a dongle the size of a smartcard you have to tether to your phone--not attractive).  

It also doesn't help that smartphone makers can't seem to settle on a standard type of port (miniUSB, microUSB, non-standard form factor that still carries USB, SD card, or other proprietary connectors & protocols) in the US market.  This makes it hard to commoditize the things.

-- Tim

>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]] On Behalf Of
>Anders Rundgren
>Sent: Friday, August 27, 2010 6:09 AM
>To: Stephen Wilson; [email-masked]
>Subject: Re: [pkix] NSTIC - National Strategy for Trusted Identities in
>Cyberspace
>

---

From: "Miller, Timothy J." <[email-masked]>
Date: Fri, 27 Aug 2010 09:19:21 -0400

>In the US I'm sure that the operators are entirely uninterested in PKI-
>enabled SIM since the USG has selected another (equally awkward) solution.

You seriously impact of the USG as a mobile customer.  In point of fact, the USG is not a monolithic customer of *anything at all* which places serious limits on what pressures can be applied. 

So if you want to bitch about the piss-poor state of PKI adoption in the US mobile phone market, blame the incestuous relationship between carriers and handset makers and the adversarial relationship between both of these and customers.

-- Tim

---

From: Anders Rundgren <[email-masked]>
Date: Fri, 27 Aug 2010 15:50:32 +0200

Miller, Timothy J. wrote:
> You seriously impact of the USG as a mobile customer.  In point of fact,
 > the USG is not a monolithic customer of *anything at all* which places
 > serious limits on what pressures can be applied.

That's something you know a *lot* more of than I do so I trust your word :-)

> So if you want to bitch about the piss-poor state of PKI adoption in the
 > US mobile phone market, blame the incestuous relationship between carriers
 > and handset makers and the adversarial relationship between both of these and customers.

I believe that *maybe* the folks representing PKI(X) also have some stake in
this mess since it is always somebody else who is supposed to do the ground-
work (for free?).  Who can it possibly be? :-)

Anyway, it seems that we agree that the NSTIC people will have a major challenge
if they are going to materialize the "certificate in cell-phone" vision and that's
essentially the only thing I wanted to say.

Regards
Anders

---

From: Peter Gutmann <[email-masked]>
Date: Sat, 28 Aug 2010 02:22:05 +1200

"Miller, Timothy J." <[email-masked]> writes:

>So if you want to bitch about the piss-poor state of PKI adoption in the US
>mobile phone market, blame the incestuous relationship between carriers and
>handset makers and the adversarial relationship between both of these and
>customers.

And I'm sure the perceived lack of value it provides and the incredible pain
involved in deploying and working with it has no bearing whatsoever...

Peter (whose comment above is based on talking to people involved in trying to
       roll out PKI for mobile phone use).

---

From: Yoav Nir <[email-masked]>
Date: Fri, 27 Aug 2010 21:50:06 +0300

> essentially the only thing I wanted to say.

Anders,

The vision document may reference PKI in cell phones as an example, but this is just an example. Authentication using a cellphone can be done by sending an SMS with a one-time code to the phone, and having the user either type it in, or an application on the phone capture it and feed it to a website. There's also EAP-SIM for protocols that support EAP.

I think there's a lot to discuss about the NSTIC, regardless of PKI. I have a hard time with the USG certifying Peter to tell John to trust Paul. I also have trouble believing that cell phone providers will (as the document suggests) accept liability for identity theft.

But I think the proper forum for this discussion is not the PKIX mailing list. 

If we limit the discussion to PKI on a cell phone, then I think if authentication through cell phones really takes off, and PKI is considered more secure or more convenient than the other methods, the cell phone manufacturers will provide a way for the phone companies to install a cert on the phone. It's not rocket science, and the processors in the phones are plenty powerful enough.

Yoav

---

From: Anders Rundgren <[email-masked]>
Date: Fri, 27 Aug 2010 22:55:30 +0200

On 2010-08-27 20:50, Yoav Nir wrote:
<snip>
> The vision document may reference PKI in cell phones as an example,
> but this is just an example. Authentication using a cellphone can be
> done by sending an SMS with a one-time code to the phone, and having
> the user either type it in, or an application on the phone capture it
> and feed it to a website. There's also EAP-SIM for protocols that support EAP.

Sure.  OTP is one option although it has severe usability problems when used
*in the phone itself*.  I guess you are thinking of the VPN use-case.  I'm
personally more concerned about the consumer use-case.

Anyway, all methods that rely on secrets stored in the phone (somewhere)
share the same basic problem; how to get it there including possible
life-cycle issues.

> I think there's a lot to discuss about the NSTIC, regardless of PKI. I
> have a hard time with the USG certifying Peter to tell John to trust Paul.
> I also have trouble believing that cell phone providers will (as the
> document suggests) accept liability for identity theft.

Me too.

> But I think the proper forum for this discussion is not the PKIX mailing list. 

That's correct since PKIX have overlooked (ignored?) the fact that there
are 4 billion users of mobile phones that surely would like to (or their
providers at at least...) connect both securely and convenient.

There are virtually *tons* of missing PKI-related standards work in order
to make this baby (pig) fly.

Well, according to OASIS KMIP TC they now have a solution that covers all
possible key provisioning and management scenarios but I feel they are way
off target when it comes to keys for consumers because that's an entirely
different trust model than for enterprise slave devices like tape drives and
similar.

> If we limit the discussion to PKI on a cell phone, then I think if authentication
>  through cell phones really takes off.

It will.

> and PKI is considered more secure or more convenient than the other methods,

It is, by a mile.   Although cell phone network authentication use a symmetric
key, PKI would work the same (for the user) for any numbers of providers on the
Internet.

> the cell phone manufacturers will provide a way for the phone companies to
> install a cert on the phone.

Yes, but due to the unavailability of any kind of normative power like NIST they
will most likely all come up with quite different solutions that will cost the
user community a lot of pain and hard money.

> It's not rocket science, and the processors in the phones are plenty powerful enough.

Rocket science no, but is actually quite tricky depending on what your requirements
are.  Nokia who have the largest market share only have pkcs12 download + import
which is about as far you can get from usable, secure, etc.

I have BTW never heard any stated requirement from anyone (except for the DoD who
apparently require that their standard access card should work in the phone),
so it seems that the handset vendors are pretty much still fumbling in the dark.

Anders

---

From: Stephen Wilson <[email-masked]>
Date: Sat, 28 Aug 2010 08:00:14 +1000

On 27/08/2010 10:15 PM, Anders Rundgren wrote:
> > The minimal requirement is a (W)PKI SIM where the client software
> > can be provisioned by OTA upon clients desire. Some operators
> > upgrade to (W)PKI SIM cards for free. :)
>
>  I was not referring to a local case where this may be possible but to
>  the general case where it does not work.

Anders, what you're doing is taking today's embryonic experience of a 
particular form factor and tool kit, noting that it is not yet well 
supported, and then extrapolating to say that there is something 
fundamentally wrong with the form factor.  There are many reasons to 
explain why SIM-based PKI and smartcard PKI have yet to take off.  All 
new information technologies are expensive, awkward to use, and poorly 
supported for a long time during the early part of their cycle.

What makes things worse in PKI is the persistent utopian vision of 
buidling one master "trust" infrastructure.  The word "trust" itself is 
deeply problematic.  We wasted untold time and money striving to reduce 
the number of certificates people carry (some still dream of just one), 
through initiatives like Bridge CAs.  Why spend billions of dollars to 
show that a certificate issued in one domain can be recognised in 
another, when you could just as well carry on with two certificates?

I believe that the TCO to provision (from scratch) N different 
non-interoperating certificates is smaller than the TCO of provisioning 
one certificate that is recognised in N domains, for all values of N up 
to some very big number.  Or maybe even all N period.  Interesting 
research question: Find N.

Back to NSTIC. Anyone else have a strong sense of deja vu? NSTIC (and 
its template, the Identity Metasystem) are premised on the idea that we 
can and *should* reuse identities issued in one context across into as 
many other contexts as possible.  It's a lot like Big PKI all over 
again.  The infrastructure needed to support cross-context "trust" is 
gargantuan; the greatest cost component comes from Service Providers 
changing their business rules and liability arrangements to accept 
'foreign' identities, and Identity Providers changing their business 
rules and liability arrangements so their identities can be accepted for 
applications over which they (the IDPs) have no control.

>  In the US I'm sure that the operators are entirely uninterested in
>  PKI-enabled SIM since the USG has selected another (equally awkward)
>  solution.

SIM based PKI and the US Government's PKI are different solution sets 
aimed at different problem sets.  Unless telcos and smart phone app 
developers are still laboring under the misapprehension that PKI is all 
about having just one certificate, the Government's PKI should be of 
little direct concern to them.  It's very sad if any PKI proponents are 
still lobbying for one master solution, because good PKI is not about 
master identification.  It's more about securing different 
identities/credentials in different domains.

Of course if government PKI can stimulate a market of tool kits and 
gadgets then that is of enormous import to other PKI solution sets. It's 
surely already happened with the Dell e-series notebooks coming out a 
few years ago with integrated smartcard readers, responsive to the PIV 
program.  And I see the $200 Blackberry reader as a wonderful thing.  
The price will come down. I'm amazed that anyone in IT can look at the 
high price of a second generation product and conclude that the 
technology is wrong.  Do you not remember the $1000 CD ROM burners circa 
1990?  Or the $5000 5.25 inch Winchester HDDs (4 MB) circa 1980?

>  If fact, in the longer run I expect the SIM to become an "endangered
>  specie" since it is not even holding our "telephone books" anymore
>  (in general).

The SIM is not actually for storing the phone book.  Its purpose is to 
cryptographically secure subscriber and carrier information, to 
authenticate subscribers to the network.  SIMs have to embody a whole 
lot of certifiable security features to prevent counterfeiting, which 
makes it them well suited for holding digital certificates and 
performing general purpose signing operations.

Cheers,

Steve, The Optimist, Australia.

Stephen Wilson
Managing Director
Lockstep *
*
Phone +61 (0)414 488 851

_www.lockstep.com.au

_/Lockstep Consulting provides independent specialist advice and analysis
on digital identity and privacy. Lockstep Technologies develops unique
new smart ID solutions that enhance privacy and prevent identity theft.

/

>  Anders
>
>
> >
> > Thanks, M.D. cell: +370-699-26662
> >
> >> Yes, if: - the customer has a contract with the phone operator -
> >> the SIM-card supports PKI - you buy the services needed to be
> >> able to provisioning SIMs - the phone has integrated WPKI
> >> support
> >>
> >> Using my definition of can and a decade-long perspective of
> >> no-avail I regard this as "theory".  Some of the handset vendors
> >> have therefore on the USG's "command" added $200+ Bluetooth card
> >> readers but I would be very surprised if the general market buys
> >> into that:
> >>
> >> 
/Anders
> >>>> and potentially insecure list of usernames and passwords to
> >>>> login into various online services" "...a digital certificate
> >>>> on their cell phone..."
> >>>>
> >>> But provisioning offline -- aka out-of-band -- is a good thing
> >>> for security is it not?
> >>>
> >>> I agree with you Anders that the USB key is a terrific form
> >>> factor.  If we added a crypto processor to the ubiquitous thumb
> >>> drive then we could put a powerful virtual ID wallet into a lot
> >>> of consumers' hands.
> >>>
> >>> USB keys are technically elegant but I have my doubts that a
> >>> viable supply chain can be built for general purpose ID
> >>> containers.  When a third party provisions a brand-less wallet,
> >>> the user has to go from place to place -- either on line or out
> >>> of band -- and have it topped up with different credentials.
> >>> Even in technologically sophisticated societies like Malaysia
> >>> and Hong Kong, maintaining a wallet of digital IDs in their
> >>> smartcards has proven difficult.
> >>>
> >>> A more conservative approach -- in the sense that it preserves
> >>> existing supply chains and legal arrangements -- is for
> >>> existing "identity providers" (banks, governments, telcos etc.)
> >>> to provision their credentials onto superior PKI-enabled media,
> >>> like smartcards and smart phones.  The smartcard is so natural
> >>> to use, and has such momentum in healthcare, government and
> >>> payments, that I have high confidence the industry will
> >>> overcome the practical obstacles: readers and drivers. Built-in
> >>> smartcard readers are fast emerging already, and the driver
> >>> Stephen Wilson Managing Director Lockstep Group
> >>>
> >>> Phone +61 (0)414 488 851 www.lockstep.com.au Lockstep
> >>> Consulting provides independent specialist advice and analysis
> >>> on digital identity and privacy.  Lockstep Technologies
> >>> develops unique new smart ID solutions that enhance privacy and
> >>> prevent identity theft.
> >>>
> >>>
> >>>
> >>>
> >>>
> >> _______________________________________________ pkix mailing
> >> list [email-masked] https://www.ietf.org/mailman/listinfo/pkix
> >
> >
>
>
>

---

From: Stephen Wilson <[email-masked]>
Date: Sat, 28 Aug 2010 08:14:52 +1000

> have a hard time with the USG certifying Peter to tell John to trust 

That's one of the very best expressions of the problem I have read so far!

The boundless complication comes from the word "trust".  If we re-framed 
the problem we might put it like this: "An accreditation body approves 
Peter to confer an attribute on Paul that can be recognised by John". 
And then we would look around and see that all of business today rests 
on existing accreditation and credentialling arrangements.  In business 
these arrangements are recognised by selected participants Peter, John 
and Paul, and not universally by any old Tom, Dick and Harry. We might 
note that different credentials with different meanings are conferred 
upon doctors, accountants, bank account holders, employees, drivers, 
patients etc. and that these credentials stand alone (they don't 
"interoperate").  And then we might refreshingly take on the more modest 
task of converting paper based credentials into digital certificates, 
with different certificates dedicated to different domains.

Cheers,

Steve Wilson
Lockstep
www.lockstep.com.au

---

From: Anders Rundgren <[email-masked]>
Date: Sat, 28 Aug 2010 01:13:13 +0200

Stephen,
I share your view 100% about the wrongs with a single PKI/certificate.

This is also the reason why I have little faith in SIMs or external card
readers as the future for "Phone PKI".  SIMs will limit you to "Telco PKI"
while external readers are pretty clunky for dealing with multiple cards.

The *multiple* keys should therefore IMO be in the phone and provisioned
through secure and user-friendly on-line protocols.

I'm a (sort of an) optimist as well but I guess that it is the newcomers that
do not suffer from legacy that will take the lead.  Apple recently hired an
expert in these matters with the anticipated goal of making the iPhone a cool
payment tool. They will probably link the phone to a cloud-based payment
service to get away from dealing with telcos and card vendors.

That's the (IMO unwanted) side-effect of having a miserable provisioning technology:
we will be extremely dependent on super providers like Skype, PayPal, and Google since
the many independent trust networks we both are advocating for cannot cope with all
those crazy interoperability issues we have today.  Yes, I use super providers
because it is simple and simplicity is a hell of a lot more important than security
for adoption and adoption is really the only thing that counts in the long run.

I guess this level of designing is a bit over the top for those who feel that the
answer to every problem is an RFC with some ASN.1 in it, so we should probably let
this thread go to rest unless there are PKIX people who have interests in creating a
slightly better mobile world.

Anders

Stephen Wilson wrote:
> ------------------------------------------------------------------------
>

---

From: "Miller, Timothy J." <[email-masked]>
Date: Mon, 30 Aug 2010 09:15:28 -0400

OTOH, broad expansion of the number and contexts of certifications has its own problems--especially overwhelming the user with decisions he's not qualified or informed enough to make.

The perfect analog example of this is Rand Paul, ophthamologist and US politician.  When he had a disagreement with the American Board of Ophthamology, he simply formed his own certifying board and certified himself.  Advertisements say "board certified" but now the user must chase it down to understand what it really means in context.

Just because we muddle through in the physical world with this mess doesn't mean there isn't a better way to be found.

-- Tim

>Sent: Friday, August 27, 2010 5:15 PM
>To: [email-masked]

---

From: "Kemp, David P." <[email-masked]>
Date: Mon, 30 Aug 2010 09:25:23 -0400

One comment ...

From: Stephen Wilson

> We wasted untold time and money striving to reduce the

> number of certificates people carry (some still dream of just one),

> through initiatives like Bridge CAs.  Why spend billions of dollars

> to show that a certificate issued in one domain can be recognized

> in another, when you could just as well carry on with two
certificates? 

How can you "just as well" carry on with two certificates if you don't
deal with trust?

The bridge motive isn't to reduce the number of certificates people
carry, it is to reduce the number of certificates issuers have to manage
for "foreign" subscribers.  If you are a Boeing employee with a Boeing
cert, why should Northrup have to learn who you are and issue you
another certificate just to access Northrup resources?   And why should
Lockheed, and DoD, and RundgrenCellularInc CAs and a hundred others all
have to do the same?

The bridge business process has to exist in some form, whether it is run
by industry-specific consortia or by independent rating agencies. The
problem with the current Bridge implementation is that they expose all
their internal garbage to applications, who then have to deal with it at
runtime during path development and validation.  The bridge of the
future should list ratings and evaluations and CA certificates in a big
(virtual) book like Value Line (tm), and every relying party domain
could pick and choose which CAs to issue cross-certs to.  (If you don't
like the word "trust", then substitute "enter into a relationship
with").   Every relying party application would then have to deal only
with short (2-4 level) certification paths: [root, cross-cert,] CA, and
EE.

Dave

---

From: Anders Rundgren <[email-masked]>
Date: Mon, 30 Aug 2010 15:47:41 +0200

Miller, Timothy J. wrote:
> OTOH, broad expansion of the number and contexts of certifications has its own
 > problems--especially overwhelming the user with decisions he's not qualified or
 > informed enough to make.
> 
> The perfect analog example of this is Rand Paul, ophthamologist and US politician.
 > When he had a disagreement with the American Board of Ophthamology, he simply
 > formed his own certifying board and certified himself.  Advertisements say
 > "board certified" but now the user must chase it down to understand what it
 > really means in context.
> 

I think this discussion emphasis the need for technical solutions that can easily
accommodate multiple and independent trust networks, different business models,
and ever-changing "politically correct" schemes for issuing and using credentials.

Right now the standard technology only supports something like a "Real ID"
which at least in the US seems to be a no-no.

Washington, we got problem :-)

Anders