Re: [kitten] PKCROSS and philosophical tangents...

["Nordgren, Bryce L -FS" <[e-mail]>]

New comment
---
PKCROSS seems to me to be about providing agility while preserving accurate identification. It seems that a section on distributed CA schemes may be warranted, if only to put the full PKI scheme in context. OTOH: Is it worthwhile to allow implementers to provide alternative methods of evaluating trust in certificates? Omar, 2009 gives an overview that I found helpful. I put some references below which may be useful for the draft.
---

Response
---
This is another long post, but it can be summed up as "agile is good", "the whole world is not Kerberos", "let users induct their pals into the Kerberos universe" and "share the load".  The various axioms and corollarys below are the main points I'd want to see given technical expression.

> -----Original Message-----
> > Tangent #1: What is "authentication"?
>
> That's a long topic.  For the sake of brevity, and to answer your more
> concrete questions/proposals, I'll not go down this tangent :)

Sorry for the lengthy post. I need to hammer out a solid conceptual framework before working out technical issues (which then need to tie back into the conceptual framework pretty directly).

> > PKCROSS introduces a paradigm where entire foreign domains are
> > authenticated by a certificate authority, to varying degrees of rigor.
>
> A "varying degree of rigor" (I like the phrase) is exactly it.

:)

> Grow your world of actual and potential peers large enough and any
> assumption that "can authenticate" == "someone I can trust" evaporates.

Ahh, axiom #1: Accurate identification does not equal trustworthiness (e.g., I've known him all his life; he's still a jerk)


> This smells to me more like authorization than authentication, but it can be
> seen either way, and it really depends on what operational details you'd like
> to have involved.  If "sponsorship" means that the sponsor has to provide a
> KDC-/CA-/IdP-like infrastructure for sponsees, then it's really authentication,
> but also a pain.  If what you have in mind is more like writing down
> somewhere that a sponsee [whose identity must be possible to establish in
> roughly the same way every time, perhaps every time after the first] can do
> this or that, then it's more like authorization, and much easier to manage.

My conceptual model is an agile, Kerberized, collaborative environment. I expect that some partners may not have Kerberos identities in any realm. (Perhaps they are a contractor working out of their home.) A conceptual mechanism is needed to induct these poor wayward souls into the realm of "The Identified" so that everyone can play in the same sandbox.

Those who work for big organizations with Kerberos infrastructure have been "sponsored" by the organization. This relationship is made explicit by the fact that their credentials are principals in the mother organization's realm.

When credentialed individuals sponsor a wayward, non-Kerberized soul, I think this also needs to be explicit....and of course distinct from the "organizationally sponsored users". And since the topic is cross-domain trusts, the KDCs need to be able to communicate this distinction to each other. It can be simple, like creating principles in a subdomain with a standard name ([e-mail]) Or perhaps using the sponsor's complete principal ID as the instance (contractor_c/[e-mail] @ EXAMPLE.COM) Or a combination of both. Or something else.

Axiom #2: Can't be authorized until you're authenticated.
Corrolary: Authentication involves identifying both you and your sponsor...


> You may not care who a peer's IdP/CA/KDC is, as long as it stays the same
> and the trust path for authenticating the IdP/CA/KDC stays the same.  If you
> can see to this then it's easier to view this as authorization.

I'll do you one better. I don't care who a peer's IdP/CA/KDC is ever. I also don't care if they don't have one at all. ;) If I tell a cooperator to connect to my system and they can't because a trust path isn't configured right...well, I want a way to assert to the system that the credentials presented are indeed valid even if they're self-signed (for a small-potatoes KDC)...or that new Kerberos credentials should be allocated with me as the sponsor (for someone who doesn't want to stand up their own KDC). And then I expect the system to get out of the way. :) It's trust path is me.

Axiom #3: Users will form collaborations without regard to the compatibility of the partner organizations' infrastructure.
Corollary: It should be possible to distribute the extra administrative overhead of technologically ill-conceived collaborations.
Corollary: Friends don't make friends learn Kerberos. :)

> > 4] human trust anchor aggregation: if several sponsors affirm several
> > identities from the same foreign realm, confidence in that realm's
> > identity should be high;
>
> You still get this if you treat this as delegated authorization, again, provided
> that you have a way to authenticate the "several identities'"
> [presumably] common credential issuer reliably.

I brought this up because my spidey senses are tingling. Too early to say for sure, but ... well, currently, KDCs act as central points of control over some sphere of influence. It seems that if the peons within that sphere of influence start making decisions about who they choose to trust, KDCs could also act as a concentrator for trust related information...In my world we call such things "Decision Support Systems" and we pay big money to develop them. There is probably value here...somehow...

Bryce



Some references :
Naranjo, J. A. M., F. Cores, L. G. Casado, and F. Guirado. "Fully Distributed Authentication with Locality Exploitation for the CoDiP2P Peer-to-Peer Computing Platform." The Journal of Supercomputing 65, no. 3 (December 5, 2012): 1037-1049. doi:10.1007/s11227-012-0842-2. http://www.cs.georgetown.edu/~clay/classes/spring2013/papers/Fully_distributed_authentication_with_locality_exploitation_for_the_CoDiP2P_peer-to-peer_computing_platform.pdf

Omar, Mawloud, Yacine Challal, and Abdelmadjid Bouabdallah. "Reliable and Fully Distributed Trust Model for Mobile Ad Hoc Networks." Computers & Security 28, no. 3-4 (May 2009): 199-214. doi:10.1016/j.cose.2008.11.009.
http://hal.archives-ouvertes.fr/docs/00/38/90/20/PDF/net-trust-19-02-08.pdf






This electronic message contains information generated by the USDA solely for the intended recipients. Any unauthorized interception of this message or the use or disclosure of the information it contains may violate the law and subject the violator to civil or criminal penalties. If you believe you have received this message in error, please notify the sender and delete the email immediately.