Re: Certificates

On Fri, Mar 15, 2013 at 8:01 AM, Anders Rundgren
<anders.rundgren@telia.com> wrote:
>> ...
>>
>> Probably missing some past discussions, what is so magical or mysterious
>> with certificates?
>
> In a nutshell, there haven't been any past discussions about certificates in the _WG_
> because the _WG_ has rightly or wrongly (take your pick), pushed this forward.
Client certificates speak to user authentication. I think you are on
the right track with authentication.

What problem are you trying to solve with client side certificates?
What problems exist in financial cryptography?

I believe the top problems are phishing-like: getting a user to apply
a secret to a malicious component. That component could be a fake ATM
machine with card reader and camera for PIN pickup; a fake server
masquerading as the real server asking for username/login directed
from a phishing email; or a fake app pretending to be the real banking
application.

While many discount it, I find the next larger [potential] problem to
be with proxies and infrastructure failures that destroy the secure
channel. What I find so alarming is many security architects accept it
as business as usual, especially when 'basic authentication' is being
used (re: your client side certificates).

My position: you don't apply your secret (username, password, encrypt
with your client cert, exponentiate with a random value, etc) or make
security decisions if you don't know who you are doing it with. We
still have not solved the authentication problem in a hostile
environment.

> Successful standardization efforts are practically without exceptions based on a
> predecessor, industry standard or conceptual design.
Design by committee is always tough and full of landmines and potholes.

My hopes are we receive something with a 'defensive posture' or
'aggressive capabilities' and others can back-off or weaken to suit
their tastes.

> For the phase one deliverable
> this was David Dahl's DOMCrypt.
What problems were Dahl trying to solve?

> For the secondary phase there's nothing.   Creating "something" out of pure vacuum
> is a doomed mission, particularly for a bunch of fierce competitors.
Clear goals and objectives will help ensure success. To have clear
goals and objectives, you need to know what the bad guys are doing. To
learn what the bad guys are going, you have to aggregate data and
develop statistics. With statistics in hand, you can figure out what
problems you need to solve :)

What problems are you trying to sole? What are the bad guys doing?
What statistics do you have?

Jeff

Received on Sunday, 17 March 2013 18:50:57 UTC