Re: [perpass] The problem with scaling authentication...

Stephen Kent <kent@bbn.com> Mon, 25 November 2013 20:14 UTC

Message-ID: <5293AFA5.3070804@bbn.com>
Date: Mon, 25 Nov 2013 15:14:29 -0500
From: Stephen Kent <kent@bbn.com>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:24.0) Gecko/20100101 Thunderbird/24.1.1
MIME-Version: 1.0
To: perpass@ietf.org
References: <CAL02cgSsznNFOjtAfMwWDBOW34LT_md3N+rUpGhDvXKM+dpP2w@mail.gmail.com> <6.2.5.6.2.20131125092440.0d240ae0@resistor.net>
In-Reply-To: <6.2.5.6.2.20131125092440.0d240ae0@resistor.net>
Content-Type: text/plain; charset="us-ascii"; format="flowed"
Content-Transfer-Encoding: 7bit
Subject: Re: [perpass] The problem with scaling authentication...
Precedence: list

>> Just wanted to observe that authentication woes are not unique to the 
>> Internet and its collection of CAs. Authenticating things on a global 
>> basis is hard.
>
> There is a significant number of examples of bad decisions. I'd say 
> that proof of possession was not used as much in the non-Internet world.
>
> Regards,
> -sm
I'm puzzled by your last comment. In the PKI context, the phrase "proof 
of possession"
(PoP) refers to a mechanism used to verify that a subject requesting a 
cert possesses the
private key corresponding to the public key in the cert request.

When an entity receives a cert containing Subject name (or Subject alt name)
that is not appropriately associated with the entity, that is NOT a failure
of PoP. The entity presumably does possess the corresponding private key,
since it can't complete a TLS exchange without it.

Steve

[perpass] The problem with scaling authentication… Richard Barnes
Re: [perpass] The problem with scaling authentica… SM
Re: [perpass] The problem with scaling authentica… Stephen Kent
Re: [perpass] The problem with scaling authentica… SM