Re: [arch-d] Proposed IAB program on Wholistic Human-Oriented Discussions on Identity Systems (WHODIS)

[Phillip Hallam-Baker <[e-mail]>]

On Sat, Aug 19, 2023 at 8:22 PM Hesham ElBakoury <[e-mail]>
wrote:

> Is there a decision regarding whether device identity should be included
> in the program or not for device-to-device and device-to-network?
>
> Thanks
>
That is a good question at many levels.

First off, we did have a working solution for establishing corporate
identity on the Web for almost 20 years. Some of that work is still
relevant to attempting to credential or identify people. And understanding
why attempts to extend the WebPKI model to people failed is also relevant.

Secondly, I think we need to take device identity separate from service and
user identity. These should be considered separate concerns.


Let's consider the case where Alice is going to use a site hosted on
MegaSite which has 2000 domains on the same IPv4 address. We would like to
encrypt the initial contact so Eve doesn't know which one. There are two
ways we can do this. One is to delay notice of the service we want to
connect to until after we have received a public key, i.e. the second IP
packet. The other is to stuff a public key into the DNS.

In either case, that public key is really a host public key, not a service
public key.


When looking at the next generation of security solutions, I believe we are
going to be focused on separation of roles, one technique for that is
threshold of course but it isn't the only one. Cryptographic hygiene, using
separate keys for separate applications, being able to track back
administration actions to specific individuals and specific devices becomes
critical.

For example, Alice has her car broken into and her laptop stolen. The
attacker may have been able to bypass the authentication on the device and
SSH into the machines Alice administers. But did they? Only way to be sure
is if we have logs that show which actual device connected and that means
Alice using a different SSH key for each device.