Re: What ASN.1 got right

[Michael Thomas <[e-mail]>]

On 3/2/21 6:22 PM, Nico Williams wrote:
> On Tue, Mar 02, 2021 at 05:06:47PM -0800, Michael Thomas wrote:
>>> It's the same problem as getting the keys into the directory.
>> But it's not the same problem as getting a cert (chain) out of the CA and
>> installing it on the client. [...]
> The latter is strictly simpler for the reasons I gave.

It is literally nothing different in use, rather than having to figure 
out how to install certs. It is ridiculously harder to use client certs. 
If it weren't we'd see client side certs all over the place. We don't. 
That is for a reason.


>
>>>> Not having to do anything at all on the client is a significant savings. I
>>>> would much rather the help desk cost of nothing different than taking calls
>>>> on how to install the ssh certs on exotic and not so exotic clients.
>>> Yes, if you ignore the part about having to get the keys into the
>>> directory.
>> They both have to do that, so it cancels that out.
> But the directory case requires things that don't exist (e.g., schema,
> tools) and also online infrastructure.  Certificates don't.
NRE vs constant help desk. I'll take that. And of course there is 
considerable NRE for certs too.
>>> We have an online CA with an HTTP API.  You POST a CSR authenticating
>>> with whatever credentials you've got, and you get back a short-live
>>> certificate for your authenticated name(s) or for the requested name(s)
>>> if you're authorized to them.  Using this is trivial.
>> That doesn't alter that needing offline authentication is niche. A Mars
>> rover might need that. My phone connected to the internet, not so much.
> You say niche, but it's not at all.  And before anyone mentions CRLs
> and/or OCSP, the real answer to revocation os short-lived credentials
> (with fast, unforgiving rotation schedules).

Where are all of these use cases that need offline verification? I asked 
somebody else and didn't get an answer.

All of this tells me that there is a witching hour with certs that 
hasn't been broken in almost 40 years.

Mike