Subject: [POSH] a POSH-ian play

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 15 Aug 2013 14:58:40 -0600

Here is a light-hearted attempt to better explain the need for
something like POSH...

###

A POSH-ian Play

Dramatis Personae

Alice, an employee of Company A
Bob, an employee of Company B
Company A
Company B
CA, a Certification Authority
Host, a Hosting Provider

ACT ONE: The Perils of PKI

SCENE 1 - No Shirt, No Service

HOST to CA: Hey, I need a certificate.
CA: Sure thing, for which domain?
HOST: It's company-a.com.
CA: Great, I'll send an email to [email-masked].
HOST: Um, actually, that won't work.
CA: Why not?
HOST: Well, I don't control that address.
CA: No problem, just prove that you're Company A in some other way.
HOST: Sorry, I can't do that.
CA: Why not?
HOST: Well, I'm just their hosting provider.
CA: Sorry, then I can't give you a cert for company-a.com.
HOST: That's a bummer.
CA: But I can give you a cert for hosting.example.net.
HOST: I already have one of those!
CA: So why not just use it?
HOST: I guess I'll have to, thanks.

SCENE 2 - Trust Me!

ALICE to COMPANY A: I'd like a secure Foo connection, please.
HOST: Sure, here's my certificate.
ALICE: Who are you?!
HOST: I'm the hosting provider for company-a.com.
ALICE: Yeah, right!
HOST: No, really, you can trust me!
ALICE: Forget it, you scammer. I'm out of here!

SCENE 3 - Reassurance

ALICE to COMPANY A: I had a scary experience today!
COMPANY A: I'm sorry to hear it. What happened?
ALICE: I tried to connect and this Host said they were you!
COMPANY A: Which Host?
ALICE: Here's the certificate they presented...
COMPANY A: Oh, actually that's fine.
ALICE: Really??
COMPANY A: Yes, we hired them to host our Foo service.
ALICE: Oh, OK. So what should I do next time?
COMPANY A: Just click "OK".
ALICE: That doesn't seem very secure!
COMPANY A: Well, check that the cert says "hosting.example.net".
ALICE: OK, but only if you say so...

SCENE 4 - Failed Communication

ALICE to COMPANY A: I'd like a secure Foo connection, please.
HOST: Sure, here's my certificate.
ALICE: Hmm, this says you are hosting.example.net.
HOST: Right, that's me.
ALICE: Um, I'm still not really comfortable, but OK.
HOST: Great, here's your secure connection.
ALICE to HOST: I'd like to send a message to Bob, please.
HOST: Coming right up!
COMPANY A to COMPANY B: Here's a message for Bob.
COMPANY B to COMPANY A: Hold on, let me verify your identity.
HOST: Sure, here's my certificate.
COMPANY B: Who are you?!
HOST: I'm the hosting provider for company-a.com.
COMPANY B: Yeah, right!
HOST: No, really, you can trust me!
COMPANY B: Forget it, you scammer. I'm out of here!
HOST to ALICE: Sorry, I can't deliver your message.
ALICE: Why not?
HOST: Company B didn't believe that I'm the host for Company A.
ALICE: See, I told you so! So how do I contact Bob?
HOST: I suppose you could call him on the phone...
ALICE: That kind of defeats the purpose of this Foo service, eh?
HOST: No comment.

ACT TWO: The Pleasures of POSH

SCENE 1 - The Delegation Dance

COMPANY A to HOST: This isn't working out.
HOST: What do you mean? We get along great.
COMPANY A: Alice can't talk to Bob.
HOST: Yeah, I know.
COMPANY A: What are you going to do about it?
HOST: Well, we could try something new.
COMPANY A: I'm all ears.
HOST: Here, put this file on your webserver.
COMPANY A: What's in the file?
HOST: It tells Company B about the certificate for the Foo service.
COMPANY A: Isn't this your certificate?
HOST: Yes, but that means I don't need your private key.
COMPANY A: That sounds good. I trust you, but not *that* much.
HOST: Um, OK.
COMPANY A: Where do I put the file?
HOST: At https://company-a.com/.well-known/posh-foo.json
COMPANY A: OK, I'll give it a try.
HOST: Oh, and make sure it's served only over HTTPS!
COMPANY A: Done.
HOST: Thanks, let's see how this works...

SCENE 2 - Success

ALICE: https://company-a.com/.well-known/posh-foo.json please.
COMPANY A: Here's the JSON Web Key set you requested.
ALICE: Thanks! Now I'd like a secure Foo connection, please.
HOST: Sure, here's my certificate.
ALICE: Hey, that matches the JWK set. Cool!
HOST: Yes, it's this fancy new POSH technology we're using.
ALICE: It's posh indeed! You're very smart.
HOST: Aw, shucks.
ALICE to HOST: I'd like to send a message to Bob, please.
HOST: Coming right up!
COMPANY A to COMPANY B: Here's a message for Bob.
COMPANY B: https://company-a.com/.well-known/posh-foo.json please.
COMPANY A: Here's the JSON Web Key set you requested.
COMPANY B: Thanks. I'd like a secure Foo connection, please.
HOST: Sure, here's my certificate.
COMPANY B: Great, that matches the JWK set I got at Company A.
HOST: POSH in action.
COMPANY B: Yep. You're good to go. I'll send that message to Bob.
HOST: I appreciate it!
COMPANY B to BOB: Here's a message from Alice.
BOB: Excellent, I've been waiting for that. Here's my reply.
COMPANY B to HOST: Please send this message to Alice.
HOST to COMPANY B: Got it! I'll send that right along.
HOST to ALICE: Here's a message from Bob.
ALICE: Thanks. It seems that we have a happy ending after all.
HOST: Thanks to POSH, you bet!

THE END

###

Peter

- -- 
Peter Saint-Andre
https://stpeter.im/

---

From: Michael Richardson <[email-masked]>
Date: Thu, 15 Aug 2013 19:45:34 -0400

Peter, thanks for that.
I think it helps a lot for an important use case.

> HOST: Here, put this file on your webserver.
...
>HOST: Oh, and make sure it's served only over HTTPS!

But, I don't get this part, unless of course, hosting provider isn't the
HTTPS hosting provider.  I think that's important to mention.

>COMPANY B: Thanks. I'd like a secure Foo connection, please.

But I think that it's wrong.  It's not COMPANY A to COMPANY B,
it's Hosting Provider A to Hosting Provider B.

--
Michael Richardson <[email-masked]>, Sandelman Software Works

---

From: Michael Richardson <[email-masked]>
Date: Thu, 15 Aug 2013 19:51:45 -0400

>SCENE 2 - Success

INSERT stage direction, showing Alice upgrading her web browser,
       calling IT because it turns out she uses IE6 because
       company-A has IE6 only intranet, and IT logging in
       to her workstation and installing Chrome and/or Firefox.

>COMPANY A: Here's the JSON Web Key set you requested.

I don't see how this is any different than doing the same lookup
in DNS with DANE.   The play would go:

HOST: Here, have your DNS provider put this RR in your zone.
COMPANY A: What's in the record?
HOST: It tells Company B about the certificate for the Foo service.
COMPANY A: Isn't this your certificate?
HOST: Yes, but that means I don't need your private key.
COMPANY A: That sounds good. I trust you, but not *that* much.
HOST: Um, OK.

It still requires the web browser and/or some other HTTPS
relying application (IM client, SIP/Skype, ...) to be upgraded.

I hear all sorts of FUD about how the "infrastructure" isn't ready, yet I
don't buy that.  What's keeping an IM client author from having enough of a
recursive (validating if you like) name server library?  Recurse from 8.8.8.8
as fallback if you have to.

While I buy that the hosting providers have an incentive to make things work,
and upgrading their software to do something useful is in their interest, I
don't see why, given that they are clueful hosting providers, they can't use
the specification we already have.