Subject: [POSH] POSH and EST

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 15 Aug 2013 13:40:12 -0600

At the POSH BoF in Berlin, Dan Harkins asked why we couldn't just use EST:

https://datatracker.ietf.org/doc/draft-ietf-pkix-est/

This puzzled me, since Matt Miller and I both reviewed EST and
concluded that it wouldn't solve the secure delegation problem. But
Dan was pretty adamant about it so I've taken another look. :-)

The fundamental stumbling block for me is that (as far as I can see)
EST provides a way for a PKIX client to obtain a certificate for
itself (i.e., "certificate enrollment"), whereas in POSH we need a way
for a TLS client to receive a hint about the PKIX certificate that
will be presented by the TLS server during TLS negotiation within an
application protocol such as IMAP or XMPP.

Here is what I see as the goal and "happy path" process in each
approach. (Note: Examples might be simplified.)

First, let's consider EST...

Goal: As the owner of example.com, obtain an end-entity certificate
for, say, the domain im.example.com.

Process (followed by EST client)

1. Discover the EST server for the relevant CA (say, "ca.example")

2. Send GET to https://ca.example/.well-known/est/cacerts to learn the
trust anchor for the EST server

3. Receive a response from the EST server containing the root cert and
any additional certs

4. Send request to https://ca.example/simpleenroll (including a
PKCS#10 Certification Request) to obtain an end-entity certificate for
im.example.com

5. Receive a response from the EST server containing an
"application/pkcs7-mime" object

6. Happily install the end-entity certificate at my XMPP server

Now let's consider POSH...

Goal: As an end user of the im.example.com service, determine what
end-entity certicate will be presented by the TLS server at that domain

Process (followed by XMPP/TLS client)

1. Send GET to
https://im.example.com/.well-known/posh._xmpp-client._tcp.json

2(a). Receive JSON Web Key set specifying the certificate to be
presented by the im.example.com domain

- -or-

2(b). Get redirected to a hosting provider for im.example.com, say
https://hosting.example.net/.well-known/posh._xmpp-client._tcp.json
(and repeat step 1 for this domain, eventually receiving a JWK set)

3. Connect to im.example.com over XMPP, initiate TLS negotiation via
STARTTLS, check the PKIX certificate presented by the TLS server
against the information in the JWK set, and if all is OK then proceed
to do various IM things through the XMPP server at im.example.com

As far as I can see, these scenarios are very different in terms of
goals and process. I freely admit that I might be missing something
that is specified in or implied by the EST spec, but right now I don't
see what that might be. Enlightenment would be welcome. :-)

Peter

- --
Peter Saint-Andre
https://stpeter.im/