Re: What ASN.1 got right

[Michael Thomas <[e-mail]>]

On 3/2/21 3:49 PM, Nico Williams wrote:
> On Tue, Mar 02, 2021 at 03:23:24PM -0800, Michael Thomas wrote:
>> So I just looked up ssh certificates which I think somebody mentioned. This
>> is a prime example of throwing needless complexity at a problem. If you just
>> added the user's public keys to, say, an LDAP repo, you get the scaling they
> In the 80s the naive assumption was made that we'd have "white pages" --
> directories -- where we could do such lookups.  I think that's what you
> have in mind since you refer to an "LDAP repo".
>
> That did not work, and cannot work because it has privacy issues, at
> least when you do lookups _by name_.
>
> Now, maybe you have something different in mind.

I'm talking about the server side sshd just fetching the associated ssh 
keys with the user trying to log in, maybe with some authz sprinkled in 
for finer granularity. It could be LDAP, it could whatever you want. I 
don't know how configurable sshd is, so that might limit your choices.


>
> The authenticating party presents a directory name, a public key, and a
> signature, and the RP looks up the key in the directory to get a name?
>
> That might not have privacy issues, but it still requires online infra
> that someone has to pay for, and that RPs need to contact (so they need
> to do async I/O, naturally).  More things to break.
>
> And, of course, LDAP is insanely complex and brings X.500 naming right
> back into the picture completely unnecessarily (along with ASN.1,
> naturally).

I'm just using LDAP as an example of a well known corpro directory. It 
could be anything. It just needs to be something online that can store 
the name public key(s) binding so that the sshd can see if they should 
allow that user/key to log in.

>> claim to be solving for, and avoid all of the needless complexity of issuing
>> certs and installing them on the client. The client ssh doesn't need to do
>> anything different as bonus. With LDAP you get the added bonus that it can
> The client is also a relying party though, since it has to authenticate
> the server.
If you care about that, I suppose. I think most people do the leap of 
faith and known_hosts ignores the problem.
>> dish out attributes for things like roles and permissions, which would be a
>> giant headache if it had to be done with reissued certs every time your role
>> or permission changed.
> Certificates are infinitely easier.  Now, you mention "the needless
> complexity of issuing certs and installing them on the [authenticating
> party]".  But that's not so complex.  You can run an online CA that
> issues short-lived client certificates based on a longer-lived
> credential, and that and "installing" the certificates (and private
> keys) are purely internal details that users shouldn't need to know.
> That works for corporate networks, but it should work for a home network
> too.  For a Mesh-like scheme you're really going to need long-lived
> (forever) device public keys and revoke them only in the sense of
> removing the public keys from Alice's other devices, and there is a
> directory in Mesh case, but it's purely local (just Alice's devices,
> which should be few enough that the whole thing scales fine).

I don't see how doing nothing at all on the client can be "infinitely 
easier" than doing a lot of something else. Every company large enough 
to care about scaling authorized_keys is going to have some sort of 
employee directory system, so that complexity is baked in. And a 
directory based system doesn't suffer from the revocation problem 
either: if I lose my phone, I can just go and delete it as one of my 
devices.  On the server side it's six of one, half dozen of the other: 
it's just configuration that is baked with chef or puppet when it's 
brought up.


>
>> I'm trying to think of major things that use public key authentication.
>> There's TLS with certs, DKIM using raw public keys, and SSH mainly using raw
>> public keys. Am I missing anything else that is widely deployed? DNSsec and
>> BGP are still pretty skimpy from what I can tell.
> Kerberos, with PKINIT.  Mosh?  But note that SSH, TLS, and Kerberos (or,
> rather, GSS-API) covers... a lot of protocols -- practically all
> Internet protocols.

Is anybody using PKINIT?

Mike