Subject: [pkix] Initial inquiry: Signed vCards

From: DataPacRat <[email-masked]>
Date: Fri, 28 Jun 2013 21:06:11 -0400

Over at vcarddav@ietf, I've started a discussion on extending the
current format to allow for cryptographically signed vCards, to allow
for various forms of distributed, ad-hoc identity authentication.

Would pkix be the appropriate place to discuss the cryptographic and
security aspects of such signed vCards? If not, might I ask for a
recommendation of a better place for such a discussion?

Thank you for your time,
--
DataPacRat
"Then again, I could be wrong."

---

From: DataPacRat <[email-masked]>
Date: Fri, 28 Jun 2013 21:44:17 -0400

On Fri, Jun 28, 2013 at 9:30 PM, Ryan Hurst <[email-masked]> wrote:
> On Jun 28, 2013, at 8:06 PM, DataPacRat <[email-masked]> wrote:

> Is there a vCard format in JSON? Have you looked at JWT?

There's a WG which is writing up a spec for jCard, a JSON-based
version of vCard. ( https://tools.ietf.org/wg/jcardcal/charters ) I'm
afraid that I don't know enough about JWT or JSON to say whether or
not they would be good solutions for the problem I'm working on. (Put
simply: allowing easy Bayesian analysis of the trustworthiness of such
cards, so that everybody and their grandmother can serve as ad-hoc
certificate authorities, without relying on any particular
third-parties at any stage.)

I am reasonably sure that an enhanced vCard could do the trick; and
there's at least one proposal on the drawing board which could be
implemented with experimental X-type nametags immediately, without
causing any disturbance to any other vCard-based applications. I don't
know whether that particular approach is the best one - after all,
anybody can create a cryptographic system which is secure from
themselves. So I'm hoping to evoke enough constructive criticism to be
reasonably sure that any obvious holes are plugged from the get-go.

Thank you for your time,
--
DataPacRat
"If knowledge can create problems, it is not through ignorance that we
can solve them." -- Isaac Asimov

---

From: "Ryan Hurst" <[email-masked]>
Date: Fri, 28 Jun 2013 19:24:51 -0700

Well for a jCard I would look at JWT.

You should look at www.Persona.org, it is essentially a JSON based PKI based
on JWT; if you were to look at a Persona subscriber certificate you would
see something that very much looks like a vCard (in JSON of course).

Ryan

-----Original Message-----
From: DataPacRat [mailto:[email-masked]] 
Sent: Friday, June 28, 2013 6:44 PM
To: Ryan Hurst; [email-masked]
Subject: Re: [pkix] Initial inquiry: Signed vCards

> Is there a vCard format in JSON? Have you looked at JWT?

There's a WG which is writing up a spec for jCard, a JSON-based version of
vCard. ( https://tools.ietf.org/wg/jcardcal/charters ) I'm afraid that I
don't know enough about JWT or JSON to say whether or not they would be good
solutions for the problem I'm working on. (Put
simply: allowing easy Bayesian analysis of the trustworthiness of such
cards, so that everybody and their grandmother can serve as ad-hoc
certificate authorities, without relying on any particular third-parties at
any stage.)

I am reasonably sure that an enhanced vCard could do the trick; and there's
at least one proposal on the drawing board which could be implemented with
experimental X-type nametags immediately, without causing any disturbance to
any other vCard-based applications. I don't know whether that particular
approach is the best one - after all, anybody can create a cryptographic
system which is secure from themselves. So I'm hoping to evoke enough
constructive criticism to be reasonably sure that any obvious holes are
plugged from the get-go.

Thank you for your time,
--
DataPacRat
"If knowledge can create problems, it is not through ignorance that we can
solve them." -- Isaac Asimov

---

From: DataPacRat <[email-masked]>
Date: Sat, 29 Jun 2013 08:51:24 -0400

> see something that very much looks like a vCard (in JSON of course).

The BrowserID protocol which persona.org is built on is, indeed,
potentially a good starting system to base my own solution on.
However, the current BrowserID spec has various shortcomings for my
purposes. At the very least, from what I've read so far, BrowserID's
"Identity" is centered on having an email address as the identifier
for a given user, while I am looking for a system which allows for
essentially any arbitrary string (eg, a domain under the user's
control, or a social media profile URL). BrowserID also seems to be
based on an identity assertion either being true or false, while I'm
trying to end up with a system that instead has a reliability level of
any truth-value between 0 and 1. (Well, more technically, using a
logarithmic measure using a unit called decibans, a truth-value that's
most likely to be an integer between -127 and 127.)

It's entirely possible that, if I can get a signed vCard format to
serve as an identity certificate (or some other method which
accomplishes that part of my goals), I'll try to get in touch with the
relevant people at Mozilla to see about extending (or forking)
BrowserID for the main application of the cryptosystem. At this stage,
I'm also willing to entertain any other ideas, suggestions, criticism,
and commentary.

Thank you for your time,
--
DataPacRat
"There is no such thing as luck; there is only adequate or inadequate
preparation to cope with a statistical universe. " -- Heinlein

---

From: Ryan Hurst <[email-masked]>
Date: Sat, 29 Jun 2013 12:26:41 -0700

Also look at : http://www.onebigfluke.com/2013/06/bootstrapping-webfinger-with-webfist.html?m=1

Ryan Hurst
Chief Technology Officer
GMO Globalsign

twitter: @rmhrisk
email: [email-masked]
phone: 206-650-7926

Sent from my phone, please forgive the brevity.

---

From: DataPacRat <[email-masked]>
Date: Sat, 29 Jun 2013 15:50:49 -0400

The complete reliance on DKIM-signed emails makes using webfist as-is
unsuitable for my needs; but the peer-to-peer distributed exchange of
authentication hash-blobs is just about perfect, for that portion of the
overall system I'm hoping to end up with.

On Saturday, 29 June 2013, Ryan Hurst wrote:

> Also look at :
> http://www.onebigfluke.com/2013/06/bootstrapping-webfinger-with-webfist.html?m=1
>
> Ryan Hurst
> Chief Technology Officer
> GMO Globalsign
>
> twitter: @rmhrisk
> email: [email-masked] <javascript:_e({}, 'cvml',
> [email-masked]');>
> phone: 206-650-7926
>

-- 
Thank you for your time,
-- 
DataPacRat