[KI-LC] [WG-FI] PKI vs Non-PKI based trust models

Rainer Hörbe rainer at hoerbe.at
Tue Mar 15 06:04:48 EDT 2011


Based on past experience that is true. But sometimes a different approach makes a difference. (Before Mr. Jobs presented the iPhone, no Nokia Smartphone user thought it would be useful or even fun to surf the web with a mobile phone.) I just think of millions of Euros that the EC dumping in IT security programs like digital signatures and eID that reach an infinitesimal fraction of todays's internet. Could a part of these resources be diverted into a different direction? Besides the known shortcomings of every public administration, governments still have a long lever in certain areas. A few impulses might move browser vendors:
- Bribe them: Every vendor with a certain market share get paid some amount if certain criteria are fulfilled
- Threaten them: Products that do not comply must not be pre-installed or in a set-up selection list.
- Provide them with a business model: If a product does not comply the vendors are liable for resulting damages :-o

Kantara could lead the effort to convince a few governments and submit the standard that vendors would have to comply to.

The wish list should not only fix the UI problem, but clean up all PKI and HTTPS issues like the elimination of domain certificates, HTTP Strict Transport Security, TLS 1.2, OCSP/CLR on by default, etc.


- Rainer

Am 15.03.2011 um 10:23 schrieb Fulup Ar Foll Oracle:

> Colin,
> 
> I agree with John, expecting anything more than "standard" HTML5 browsers in the next coming 10 years will remain at "conceptual" level.
> 
> Not only it would take 10 years to move browsers vendors, but it would probably take an other 10 years before those new browsers arrive on "normal" user desktop computers.
> 
> Not an option for me, I'm too old ;-) 
> 
> Fulup
> 
> 
> 
> On 14/03/2011 23:25, John Bradley wrote:
>> 
>> Colin,
>> 
>> I spent many years with the PKI Forum and other places pushing the better browser support rock up the hill to no great success.
>> 
>> There has been no detectable improvement in mutual TLS support.  On the other hand EV certs got in because there was a clear revenue model to the PKI Forum participants.
>> 
>> Some of the problem relates to TLS itself and the rest with the browser venders.
>> 
>> If I had to get one thing from them it would be a way to do ephemeral keys for HoK as STORK and others have been asking for, also to no great success.
>> 
>> If someone wants to put together a gang to take on the browser venders I am in, but I am realistic about any real progress after 10 years or so of trying.
>> 
>> John B.
>> On 2011-03-14, at 5:56 PM, Colin Wallis wrote:
>> 
>>> So the problem with client side Certs is the way they are implemented..with security in mind only, not privacy.  'Promiscuous' is the label given to them down here..
>>>  
>>> That's why the NZ Government does not use them in its consumer online service strategy…
>>>  
>>> And I might point out that it's too much of a generalisation for my comfort to say to that 'eGov prefers PKI' (Rainer's 5th bullet)   
>>>  
>>> The lines between law enforcement/security (with no privacy) and consumer service/security (with privacy) seem to be getting blurred in some folks' minds (certainly not Bob's, nor John's..)  
>>>  
>>> <<BP: For example, could Kantara have a role to play in making it practical to provision client-side certificates to consumers, so that websites can enable the use of two-way SSL for consumers who have client-side certificates>>
>>>  
>>> Maybe, but I think it won't be listened to.  The change has got to take place at the doors (hearts and minds) of the browser vendors, and the logical co-ordination point for that is the CA Browser forum.  I'm trying to think of the directional pressure that might persuade them to tackle this problem - the Data Protection & Privacy Commissioners group? Maybe. Kantara? Nope. At least not unless KI is pushing at an open door..
>>>  
>>> Cheers
>>> Colin
>>>  
>>>  
>>> From: lc-bounces at kantarainitiative.org [mailto:lc-bounces at kantarainitiative.org] On Behalf Of Bob Pinheiro
>>> Sent: Tuesday, 15 March 2011 6:16 a.m.
>>> To: John Bradley
>>> Cc: dg-bctf at kantarainitiative.org; FI WG; Curry Patrick; Kantara Leadership Council Kantara
>>> Subject: Re: [KI-LC] PKI vs Non-PKI based trust models
>>>  
>>> Regarding U-Prove and failed efforts at consumer PKI:
>>> 
>>> For high assurance consumer applications that (should) require strong authentication, such as online banking, payments, access to patient health records and other sensitive personal information, what are the possibilities for doing strong authentication?
>>> 
>>> Since PKI doesn't seem to be a realistic possibility at the consumer level (at least not now), it seems that the current choice is limited to one-time passwords, at least for consistency with IAF and NIST 800-63 v1.0.2.
>>> 
>>> U-Prove tokens are a potentially viable method for transmitting high assurance claims to a RP for these consumer apps.  But even so, the consumer will still need to strongly authenticate to either an identity provider (who issues the tokens), or to a cloud-based active client / token agent  / claims agent.  Or both (??).  With the demise of Cardspace, the use of a self-issued infocard for performing this authentication seems to be out.  
>>> 
>>> Joni has asked for volunteers for a strategy subcommittee to help Kantara become more effective, attract more members, etc.  I'm wondering whether one possible strategic goal for Kantara could be to help transform PKI into something that is practical for use by consumers.
>>> 
>>> For example, could Kantara have a role to play in making it practical to provision client-side certificates to consumers, so that websites can enable the use of two-way SSL for consumers who have client-side certificates?  
>>> 
>>> A second possible strategic direction is to help in getting U-Prove to be implemented in a way that is usable by consumers.  There is a related effort in the form of a claims agent working group in Identity Commons, but that is not specific to U-Prove.   
>>> 
>>> Maybe these thoughts are best discussed in the strategy subcommittee instead, but I just wanted to put this out there and get some sense as to whether anyone thinks these might be reasonable goals to pursue.  Or not?  Would such goals stray too far from Kantara's mission?
>>> 
>>> Thanks  
>>> 
>>> Bob P.
>>> 
>>> 
>>> On 3/14/2011 10:50 AM, John Bradley wrote:
>>> I helped start Xcert software (now RSA KeyOn) 12 years ago to work on federated identity issues using PKI client Auth.  Why PKI failed in the consumer/internet space is a big topic.
>>> I should also mention that u-prove (zero knowledge prrof) cryptography contains elements of both certificates and assertions.   I have limited expectations for any short term traction on that however. 
>>>  
>>>  
>>> On 2011-03-14, at 8:08 AM, Rainer Hörbe wrote:
>>> 
>>> 
>>> John, Patrick and I had a discussion about the pros and cons of federation models based on credentials versus assertions. The attached document is a preliminary result with conclusions like
>>> PKI and non-PKI federation models need to be combined in most cases at higher LoA
>>> To implement a federation an RFC 3647-style policy is insufficient; A more complete Trust Framework is needed
>>> Whereas the Higher Education sector favors brokered trust, e-Government and Industry prefer the PKI approach. But it is not a question of one way or the other. 
>>>  
>>> Request for feedback:
>>> I wonder where this discussion should be homed. FIWG, BCTF and TFMM are related, and it is also an extrakantarian issue. Any interest to take over this discussion?  
>>>  
>>> - Rainer
>>> <pki vs non-pki.pdf>
>>>   
>>> ====
>>> CAUTION:  This email message and any attachments contain information that may be confidential and may be LEGALLY PRIVILEGED. If you are not the intended recipient, any use, disclosure or copying of this message or attachments is strictly prohibited. If you have received this email message in error please notify us immediately and erase all copies of the message and attachments. Thank you.
>>> ====
>> 
>> 
>> _______________________________________________
>> WG-FI mailing list
>> WG-FI at kantarainitiative.org
>> http://kantarainitiative.org/mailman/listinfo/wg-fi
> 
> _______________________________________________
> LC mailing list
> LC at kantarainitiative.org
> http://kantarainitiative.org/mailman/listinfo/lc

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://kantarainitiative.org/pipermail/lc/attachments/20110315/1b3055ab/attachment-0001.html 


More information about the LC mailing list